155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37fa

Analysis

max time kernel
150s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
Size

52KB
MD5

37b65f86aba2dab93dfab47817eeb270
SHA1

37d994fc2af4770d74ad80126dce4faf2c604a21
SHA256

155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37fa
SHA512

932106594abba02e909e07c278864823b039b46547adfd1303b84bfe79983ca2c45c5ec66f6d91218979beba89e6cd358613ae91984d1f0879f66b6a3635c7b5
SSDEEP

384:yBs7Br5xjL8AgA71Fbhva4S04Shk5c5iZGba14:/7BlpQpARFbhS101hk5c5iZGbJ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5249) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\MSO20SKYPEWIN32.DLL.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\EEINTL.DLL.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSUIGHUB.TTF.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ODBCMESSAGES.XML.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessResume.dotx.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\NIRMALAB.TTF.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe

C:\Users\Admin\AppData\Local\Temp\155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
"C:\Users\Admin\AppData\Local\Temp\155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
53KB

MD5
a94c0ee2a6bd69da5656836dcb7b838f

SHA1
78c8c9f635be5d36d80c7991fccfd84b56e9f0d3

SHA256
462840a3d4dd7b87c0003a0b2d8a19d65672dbb98b2013c024dbdc1228b11888

SHA512
19928779c6475324a829dea1a1b7a4891d1097496ec6bd8feb72a2a135ca5071d4013eb1f13ec2f769ef5a6d4f5cc1c14000c173118c50b7931a5e12328e38b6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
0a73934006408c34a5412ecb9dad2a8e

SHA1
ea4da36c80eafc427798e53eb3ddff6695b7fc26

SHA256
c3465a55b83bf64d21b7dc9a713aaa713206fd014c8da8991782209daf6c8fd2

SHA512
4db9b3d1a0ec58b68da4fa944844448841e5ff5dd55210fe20850c2e4972af3b603d84084fbf621563e4f2283eed884f432a07435c4c400f119632540fecf940

Download Submit
memory/3904-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-868-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download