a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe

Resubmissions

19/11/2024, 16:16

241119-tq884axqe1 9

19/11/2024, 16:13

241119-tpchqsyfkk 9

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
Size

149KB
MD5

798f3a3fddcabbc80f9f5c68f94f0408
SHA1

0172c7c3401dbecd89e562167e9dc32b52da7652
SHA256

a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe
SHA512

d99339154fe1eeac97a6c6a7858804d465bd741d89a2391716e87a1875f17789ad12b77a7aba3d0f68bf2196499dbeef876e5f173b596e04c84b5114b7461170
SSDEEP

3072:6rWpcsHEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsP9iMGfU8:tb9iMGsSaOyif

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4361) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwritalm.dat.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe

C:\Users\Admin\AppData\Local\Temp\a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
"C:\Users\Admin\AppData\Local\Temp\a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini.tmp

Filesize
149KB

MD5
28fda66a27853d58894f0486d58792a2

SHA1
b4403adf4b879af421ae442caac99972997f3f98

SHA256
2a15f9c2bc72d235f25051b3d76f492c3330d623428492a15b285de578c8787a

SHA512
c28b1582d346d31c63c042c4e454bf70d60674232840a6eeca8845c9dfb3b06629ec3643349f07011669b19dd2d54981883572be2250102211bf51363b690468

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
248KB

MD5
e66624f4fbdad1ea512b5c30de92b9f2

SHA1
c87c4c8cb1ff765a1e5ccc4b7534b7017317115c

SHA256
e1f72a820126f4d93dcae6ff9ea6e0995a5cfa90c440216cd0a967f2fb13f4ed

SHA512
de78bcb61eda994ad2ee72f1a3c8495708117323cf4fd56f72bef6f956d6960fe938272d7fb7298f175b487305553f39a5dfbbd70c535bd423c58128689fb834

Download Submit