82cae1141270f65eab38993b94c60ee533bf459211547bf85ca9dc7b76bdef27

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6db14ae372d63583503ca1c4b843bc80N.exe
Size

39KB
MD5

6db14ae372d63583503ca1c4b843bc80
SHA1

30ad3cb710100d4321ef655d815ddbd34f9bc7a1
SHA256

82cae1141270f65eab38993b94c60ee533bf459211547bf85ca9dc7b76bdef27
SHA512

0c60f21482c8f4e571bc1a104ce2328b262a3dff94f39fb526641c926494cfbbeec5685c092a17f0a006510932daa531cdf926106f947d640077c7f9f6cc00e8
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHBDPeLS9I/sExeLS9IR:yBs7Br5xjL8AgA71Fbhv3UnUM

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2668) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClient.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	6db14ae372d63583503ca1c4b843bc80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	6db14ae372d63583503ca1c4b843bc80N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6db14ae372d63583503ca1c4b843bc80N.exe

C:\Users\Admin\AppData\Local\Temp\6db14ae372d63583503ca1c4b843bc80N.exe
"C:\Users\Admin\AppData\Local\Temp\6db14ae372d63583503ca1c4b843bc80N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
39KB

MD5
48f23d755af7aa3bc1143cf7de23cdf2

SHA1
b5834fd5fc15eaf6df6e91157d41ad887905b6fd

SHA256
2d55f1c11fa3c128b51654791e07db2e94222546cabe89dcf0e62734f6543d46

SHA512
8afb37045a13a44edbffdbf61e0aaddfbc4e4209439c4f69c8e75a579abd4f1716343d88f21118ae51d6db4fb283639c013bcc5d3e0e143ac88bb892188cf417

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
138KB

MD5
62797cc038503424f6530f2ece8c9f45

SHA1
4280684fe39abc586d669953484670cb02cbc484

SHA256
9df801915674e0e8d63f41596958002cb58ff7d2e67b372a5ebad1cab0432b15

SHA512
c203020e3a2466d2c7b854c6b85a0257d5c041a4389d3fec8013df95fdf0e934f78b2788d7e631155e53294665b7ee05b3e2a046591b78f00c8513c6ffe2ef65

Download Submit
memory/3104-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3104-1586-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download