63da49a101677f051ca492079d439402b2316c67ea786aa9ff3c57ae5046ca1d

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4587ec5f87a22b22d5c7e20ab19761a0N.exe
Size

47KB
MD5

4587ec5f87a22b22d5c7e20ab19761a0
SHA1

68952ea4f7f30e23b3a5c2b5cfc3ac77c288aa43
SHA256

63da49a101677f051ca492079d439402b2316c67ea786aa9ff3c57ae5046ca1d
SHA512

190db74cca31acc5e0d3f105667287be7f5e2911115f01b28f82f95473751e7af1850ce5f3eb03bb641641f472f9e03d2ac8f21af380c667d15a2c4eabc02213
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpZi4w9i4wMNFpOyPRRRTFMu+RRTFMuf:W7ZppApBULcfpHLcfpVwhwMDpOyPRLKn

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4242) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ar.pak.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\net.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	4587ec5f87a22b22d5c7e20ab19761a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4587ec5f87a22b22d5c7e20ab19761a0N.exe

C:\Users\Admin\AppData\Local\Temp\4587ec5f87a22b22d5c7e20ab19761a0N.exe
"C:\Users\Admin\AppData\Local\Temp\4587ec5f87a22b22d5c7e20ab19761a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-464762018-485119342-1613148473-1000\desktop.ini.tmp

Filesize
47KB

MD5
9c0abc69b73fcf6924bfebc1bda18888

SHA1
61751d6405deaff0c8c9dbd8d07a8bc7414d95a9

SHA256
00a2fada322f62af9a429d4ffc70d7f916a3b61fa3cc837e56b51e16266690fd

SHA512
1318996f7c2de588564cbdf91e307a387fc4a8705279633f42eee987fecc860e514b7a185a784347ee5912ee1d68da0b15e2d1d19955f7b6eb4cd68b2fc4f180

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
146KB

MD5
6580ae1c0a5fb218c137f47f088ff13a

SHA1
8bab7d76b32c7019f51b2791ecc3dc9edce15392

SHA256
a04593485ee57d88f9fc203e40b6e167488a26ddcf024687076f65325f4a8d2a

SHA512
d304eedcd05d34fe502f9451b2e4107258df74f34735ea9b512a90f6357c2c0964817ddea1452fd6762551bfeb94c0d28677935f1af02ca4493a913db9b012d3

Download Submit