61a8b0dc95f73f935b15f664f7bf207639e1670222a60b24b244db637dcf0575

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4783863082f561c2e28e3690fa649130N.exe
Size

86KB
MD5

4783863082f561c2e28e3690fa649130
SHA1

c3f072de7ae0294583aa3637058308ffa0990185
SHA256

61a8b0dc95f73f935b15f664f7bf207639e1670222a60b24b244db637dcf0575
SHA512

bebaf220833fbed74b9f494cac1f4ab825325da23966d949cd0f3811da6f001197149b1a9403750a1b083100f8d3eda9b89aa4be01c313a7295c4f903f341248
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBK2LUf7XQBhVzhVx:69WpQE0zUzXYb3

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4108) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NetworkInformation.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	4783863082f561c2e28e3690fa649130N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	4783863082f561c2e28e3690fa649130N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4783863082f561c2e28e3690fa649130N.exe

C:\Users\Admin\AppData\Local\Temp\4783863082f561c2e28e3690fa649130N.exe
"C:\Users\Admin\AppData\Local\Temp\4783863082f561c2e28e3690fa649130N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-464762018-485119342-1613148473-1000\desktop.ini.tmp

Filesize
87KB

MD5
daff86524d63566d53dbf6201332f8d1

SHA1
19e053312323ac93afa25728e3b71cd4f024de31

SHA256
d4e7bb1b74f62cc9d4111caca55ccecf8040a8e4b31970486f5ce4e1f5a2b294

SHA512
a65cad9cbcfbd8928055753b65b75fdcc97ca213111e14b04af41d7d5b321cfbce73bd81044b09c910f66e63e689522e8d8a00d6e76e878875bdfbc51a243de1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
185KB

MD5
21ecf58bcbe7b580196c797a5f3a557d

SHA1
c96c19027533778c757f8dc2a297e237d3190939

SHA256
b095efdcbfef26ce2dfcb797bce84930b8d573a036eee732a308e8b7a7948d53

SHA512
e62390068698d6c30739f9196d7b029409d3d11c5e05ed7a1c554c0db4e2c648c6ade9a6b8f0d8d0ab83d8ff7cd2af7453bfcfd68369324f548fcc3b2d9c5590

Download Submit