79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
Size

39KB
MD5

9f3e06180fd6ae1fb88a17b6d3be6a30
SHA1

c3250317a7a3c5d0dd40f5bf3029cb205b9b84a8
SHA256

79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976
SHA512

33d8dbe2dccd23f46a44bb008bf5332af56f9c672819309b97719685dfc93c87323610e4bdbe704fd0e13114cc339503500b48065a03b4c7e81a3f9ae0a8ec24
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxjc8P8dzNNlNN+3:yBs7Br5xjL8AgA71Fbhv/F1UXNHNWV

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4650) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe

C:\Users\Admin\AppData\Local\Temp\79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe
"C:\Users\Admin\AppData\Local\Temp\79e004808609579c0c0143f3f614fec37dcaf71a6c8ad41dcfa73c5047b77976N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
39KB

MD5
f98aee9927ea9d5457f15051d0ed92e3

SHA1
3e9551f248c1a58241caa69ce59844b03bb867d2

SHA256
0d3f100f98903f77013d4eebac9061a23a55a3dee983ef0ac4cf86905cacaa4b

SHA512
b050fb69df1d965e8b5d43c816fedefd5e4bd3069ce9b05e8cf596dabff3dd5d9c1084e86b94a6556c02dcafcee853b56e7b47611cda661f96b416097a223e89

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
138KB

MD5
af58bdc0e1cc685406b31277823ab453

SHA1
b061ab7814052c59828d9b54d285622c3a9a8223

SHA256
d81774f4d6771615cb29813141c311968557c64b400a00ee0767e7e421c096a8

SHA512
d42ff2a13a1b3291123badfac01f2e08663323eca19a591cb8a5e8edf06f0505dbdb2388f9aa33474ed5f01d6779e7bebcfd0f37221774157cf03cbab3e864de

Download Submit
memory/3424-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3424-942-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download