7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
Size

83KB
MD5

80ac9757c801b0417847fdc400f9c030
SHA1

8f7756fc39c40b7d04c1c152b010072571a32a2d
SHA256

7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8
SHA512

5c09bdeb999dfea3ab585975d72cd654c94799516d6ba2dc4e9bc055cc5044748b02e9d103f48319e37e7b764134c6c7d6c0d1095f302607eb349723a4934d06
SSDEEP

1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGLtErY:6e76mQSohsUsUKDtErY

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4526) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe

C:\Users\Admin\AppData\Local\Temp\7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
"C:\Users\Admin\AppData\Local\Temp\7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
84KB

MD5
5210b1a5f752c79585a13648af7259d5

SHA1
5450627f5fe4dbfc071012bef0d7507f0fe5359a

SHA256
b03a71c8a8e08af93f39d57a88722348596f273556da035b3da21fa39e71cc90

SHA512
4d7a9857dc4421c2763634cd311859bb4b38a8c3f6274da8e3328d685d0a339b28ab673d453f15140288fe8be40cd76e21d84c5d4e5537f2883d3b19c811446d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
182KB

MD5
3f18cc8238bb44f2c0ebead8efe73883

SHA1
39ca9f19f1506a494ef8e2a0bb4951b10bc3a8f7

SHA256
211398cf4555748a067b50ea60ba9ac38eda370679437bad0f9c0ecae2f934b8

SHA512
e48f61ff4d5ee63de036855879dd0dd6d0ad7821995af7639d9d708f8f24ff2c012c4c62954e8b9e72e58cda46e16e221b10af5cb09eafa8840737c4fece8fdc

Download Submit