7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
Size

72KB
MD5

d0343278a85072841bcec49a65c1e53d
SHA1

46a2187579153d195f6843ce8ae45baf91470475
SHA256

7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93
SHA512

d320d37bf9d41330bd8f9f02169439d129fbe2f1c2c98c5a111a7027f9e5122d75210b2db3068c690bba29612636e549131e4bd00fbbc4f3da42b92d28fb9f66
SSDEEP

768:W7Blp+pARFbhtlmlQ3y3RWvf+wi1x9f+wi1xBTCcX8vgCcX8vSd5hdx8M8Ya:W7Z+pApfGQ3y3RWvfmRfm9sKsSd5gYa

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2525) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Xml.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationUI.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\hu.pak.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\uk.pak.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\gu.pak.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\resources.pak.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe

C:\Users\Admin\AppData\Local\Temp\7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe
"C:\Users\Admin\AppData\Local\Temp\7d9de4f16dd4bbd6207dd5e6f4ec0ec5d2b3c6ebd1437cb3cbac833e472b6b93.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-464762018-485119342-1613148473-1000\desktop.ini.tmp

Filesize
72KB

MD5
108f719b49e124e874679aa094d949df

SHA1
e451b038b7c13a6e6b7c4125843bb2ef020f7a8a

SHA256
7ea54caec6405f511a8bf0832c1eacc0f3df5b615ca86c174e7741d9a8087ae0

SHA512
ac6cd4f83ef4391434fde8874323fb1e14dcf60c249a580ebd37d7dd4f593f788eb3aa6a329d5b2a478c2761c1795caae26b0ec9e5e5a1f250aa29dde4397235

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
171KB

MD5
c615d1499810f73f019e429d99b9b831

SHA1
588c767dc670bddf2e4baf68b7285a621f1cc86b

SHA256
33c33f967fe13d48f8d4c0bf1be1c9a5f3ba575e60bd94ea873546a46c397ba0

SHA512
947bd02fab5d0b0d22f7bf64b3448ab20cc5875123a80e80f62d985b42da43a591541475dbac95a5b7244d28337117c2534b9d0c1b81674950f02565a28bc876

Download Submit