2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
Size

93KB
MD5

b00090583c9b21ca7321807061c391d0
SHA1

6aedc216adfa6399af8ed96848200bd8e29bac9c
SHA256

2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7
SHA512

38c45719e78a4b688777c4a1d4bb59ed491f643ec4b00e80c708e1acde870bb39dd64ae3ba561ffd61c86e9a5215b5eaac67e0434215bc654458fa858f5f9c93
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKgg0///x9zK/:69WpQE0zxg4ny

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4367) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe

C:\Users\Admin\AppData\Local\Temp\2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe
"C:\Users\Admin\AppData\Local\Temp\2a02cd370b38d88e5415972df7263071d228ebb62b1fe552fbe8f065848006b7N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3908,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
1⤵
PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
94KB

MD5
eff675fe156eb817cc082cad42e6661a

SHA1
42916eb302d58f4c7a7902c2ab30fac25a2a431f

SHA256
3318d44a1c6212252ff1bc8c5003ddea05a404d712448bdcb4c59009a750e721

SHA512
cacb1c2f96f9704b8d276bb22cb470586a471217fc0a67371713450b0c3a74345af97a4b4da9fc65412068d8d207477c9dd2f54df84511b1a6053510e12ed689

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
206KB

MD5
8a08aae3d1bb24369fbb9efadbde470d

SHA1
362b867dec48910d1307e2a8cf391f7cf461c500

SHA256
7133a911d8dd0bc6a0051b4584d128788d70ec0d433991123c2ece13248c4da8

SHA512
a51c2b4815a846fcbeb38a530269dc1fc19c4d33292859d925bd3daa1c42a622b024ef7696f701099b3192df99a8931b54927965223b3e6954f312d68ee69392

Download Submit