de7b29c27a551e77b78f39cb705e9a014eb032aaec1b89a8fb8ddc11258c53e4

Analysis

max time kernel
119s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f2d8b98d8bf268d013d2ab72376f440N.exe
Size

51KB
MD5

4f2d8b98d8bf268d013d2ab72376f440
SHA1

f3bdd56fe069bbf7603eaef5ce85b305f26ce1e3
SHA256

de7b29c27a551e77b78f39cb705e9a014eb032aaec1b89a8fb8ddc11258c53e4
SHA512

2445af854ad84456a19f99b2b3f30d5c8d9d1e3abb74a5b0ec3495dc6e207f32db112f862e33108213c58810d1d5d4030f1de66c7da3d3630402f897ab53db73
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPqAlJIqAlJVUrn5c5rll:/7ZQpApze+eMUL6l

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4615) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\manifest.json.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Common.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	4f2d8b98d8bf268d013d2ab72376f440N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f2d8b98d8bf268d013d2ab72376f440N.exe

C:\Users\Admin\AppData\Local\Temp\4f2d8b98d8bf268d013d2ab72376f440N.exe
"C:\Users\Admin\AppData\Local\Temp\4f2d8b98d8bf268d013d2ab72376f440N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1403246978-718555486-3105247137-1000\desktop.ini.tmp

Filesize
51KB

MD5
8c7f5ecda68e564f618760983d05e064

SHA1
d77bc8994fb44717be6e5c1eef3cf020f4b1f443

SHA256
3909e1fac03d6cf8456725253e479a6126cb828e73fe31d70441add3b8fa018e

SHA512
72c4c1e406c990a98a477c3991a7d875b1fd47f707e18224e9a83e7298cc9b714baabe4f04d80f6f88cd348361aa202771dff5698ba924a4b0496641015d1ca6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
8b2edb25bb7709d3e528a33fdb76d61e

SHA1
d056a54eb22deb3aaeb359c0098f15320a7a020f

SHA256
c2f241a00128fdac792e1e0c58d7098527dff0d08ceb1b43e7e08076d255dada

SHA512
20b2603c5226612cbb2d263e6ceafdbda0a5d12d81774654b369243fb92c0d59cf38806bec3be4d47a63a5ddb50792f571302f9842af6cbb17d75944fa1f19d9

Download Submit
memory/2040-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-1878-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download