9cb4825b51c08ad63c839b2c5a02b3b406484f94c9fd7f6a4a904b30e6bc7602

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
Size

85KB
MD5

0b6d9648d8fc5e0f99dee5b1c5a25310
SHA1

2e56a36339d4f8ae133017318a96a653c09c9cbe
SHA256

9cb4825b51c08ad63c839b2c5a02b3b406484f94c9fd7f6a4a904b30e6bc7602
SHA512

e8bc05225c51706021360ef26d1c0adde012dda81ae60732e3018cc732bf6df79810543085019a9d35860d7f5cad656ac82de2b576975e97ee591c355b66ecc7
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhT:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsy

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4359) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\da.pak.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\resources.pak.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b6d9648d8fc5e0f99dee5b1c5a25310N.exe

C:\Users\Admin\AppData\Local\Temp\0b6d9648d8fc5e0f99dee5b1c5a25310N.exe
"C:\Users\Admin\AppData\Local\Temp\0b6d9648d8fc5e0f99dee5b1c5a25310N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
85KB

MD5
6e45bd96ad2a876ff4e3838aa3abba9a

SHA1
7d0906cfefb46a6cfd15772a6b2b178489c6c5c0

SHA256
dd3593a43b5303f17a9fbd624313358df41b1c56760d706498a9ed19ef5c83c2

SHA512
140231a03516a2b0fc1af7d4dab159a53ceeac751e6813352a36df1bce6f141bc711e85c3aa4049813b328809acba56bb69dd911464dd56005a15847b103f5bb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
184KB

MD5
fe320f29be304888e095a253200c8c38

SHA1
5c133993dc3321a78a770048573340b5206431be

SHA256
f808788acebf15a6757cc548012b853f58d589c64f028596c07d4978f3520c00

SHA512
29f4ecbfefa0e6ae2ced61b0849e285664fa1b5e30a084aa543b5a1f2dd93e9de9d504d33b47b7266c37afaca2c73fb245a912bb24a99323e8aa1d052b3c29dc

Download Submit