571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
Size

68KB
MD5

df12da9ac92c7f8832cbbc60a5e725c0
SHA1

0d604a2370062d5c13cf2711adb0a11346399024
SHA256

571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048
SHA512

056ee2c04e78e43253e90e642d75fcaa181c45852ea9f363ac4c7d15d287263ea45158b72c43b728cabd55fdd1149c2db1fceb039a70e3b0047272d87fbef133
SSDEEP

768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeq:W7ZhA7dAynMdyGdy4AnA4QLIyIBz

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4156) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe

C:\Users\Admin\AppData\Local\Temp\571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe
"C:\Users\Admin\AppData\Local\Temp\571e6eb6e17a9aea21916756a4df50f048abbf67c083ae6512a9602a54fb4048N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini.tmp

Filesize
68KB

MD5
54bfcd7b704e0c0eeb3247e8a4e599fd

SHA1
22f5092187c37d4ee1e974d50297de4d279ae6a4

SHA256
90e8ce377a17ffad7842114dec3617b60d1d61ed80f8a427ec17cdd278d480ae

SHA512
b9964515b899e66a6a6c3751a656dae3864b842ba572afd41c9afafad060c4ac1a74a38ec88c6f4a38aa72b7c517b392eeb15bafb840d1131ce3e9d94252478c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
167KB

MD5
c94391eddaad61abc688993a66194b97

SHA1
fb047ee816ce746582068548d07e27055cbd40b7

SHA256
df509e8afb7a46badc9be7fd864d43c570f8ba3d73d2e252eb0162488fe7ded9

SHA512
5e865244dd5ab8f090dee781b462d729cdb6debae2e143359597972851147d16d6195b473225a2eb07b32169449a3ccb7fd9091d2803c06a6f7d9f24e513a6ba

Download Submit