86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
Size

45KB
MD5

976710d976a44df9e5133ffb90317683
SHA1

501451de784ecf2064799a2e648c4b609b7e0bcf
SHA256

86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001
SHA512

bff2eed745d7c8e403eed872df90122c1c2155c2b0ec46b011c50f33dbd736897b85b6324371ad5fe68bb1d0daa2285a559a404b987882435ca59528144be8a3
SSDEEP

768:W7Blp+pARFbhBgnKLMWK9WKD2N2LSarSaV:W7Z+pAp2nKLRKIKqoLSarSaV

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5029) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.TLB.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PEOPLEDATAHANDLER.DLL.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe

C:\Users\Admin\AppData\Local\Temp\86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
"C:\Users\Admin\AppData\Local\Temp\86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4360,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:8
1⤵
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
45KB

MD5
e65e5ba7279ab64acf6c1b48f3838540

SHA1
6a7b489b6dff2807f2e4855ae12db6fddd354910

SHA256
1a7f78586fecf532882f410906dbbd9942da32b0e4450ece3e9f632019b461e0

SHA512
c439b6a58438ff942b69a4364d6ce6f34f3c41cbfe08dc95d1e03feb18008ebe2e33ff3fc16d30b9a269f9a40b39fa8eb663e42b85ba346c568ec0efa6ed2573

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
158KB

MD5
df42cae7980bfed4ebc2bbf5b533505b

SHA1
9fcf8ccf7e7aec52a665a1155409ef4cf8697370

SHA256
d1e4cb82e76e74b7ef261717bb4ee09ca5a3196c55298fdbaac80ab86808e70c

SHA512
a725f56fec15cf4708363e6f983986aeadad3544f74471aecc09512a659013d961297ce1a7ab13b3483149fbd50072dff6d6a08f12c6e37766038d6ab151e253

Download Submit