207e99e5429116e89af206741153aa8f4eede0cd7ad8586ab27b81c59de3e0e8

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6289cab9a0ad98f59040b8a8496596b0N.exe
Size

101KB
MD5

6289cab9a0ad98f59040b8a8496596b0
SHA1

7c10720ae6fb223f03879d4e9d42580121e105d8
SHA256

207e99e5429116e89af206741153aa8f4eede0cd7ad8586ab27b81c59de3e0e8
SHA512

3f92c10e7b1da2d9582d1af8a710db65a6cd21aa379ca8f6185fe972b94da3fa01b0161777bc0fab0513347e8624087632218630f585094a35336642c782cad8
SSDEEP

3072:9QWpze+eO888888888888888888888888888888888888888888888888888888U:Lpe+ekeP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3984) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\dxcompiler.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jmc.txt.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\123.0.6312.105.manifest.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms.tmp	6289cab9a0ad98f59040b8a8496596b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6289cab9a0ad98f59040b8a8496596b0N.exe

C:\Users\Admin\AppData\Local\Temp\6289cab9a0ad98f59040b8a8496596b0N.exe
"C:\Users\Admin\AppData\Local\Temp\6289cab9a0ad98f59040b8a8496596b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini.tmp

Filesize
101KB

MD5
b88fd02247ca6722024ef5b9ef997945

SHA1
9f663f09125e72f6d3f31227c345f39cf88a39a3

SHA256
7edcc52e77180bfde570baf69b59ae61162d219a18c2b4514512de2744533ebe

SHA512
363643b3e44ae2da800738dcd552e48ce93618f73e90c1bba3dcc66482c70bcf3b4788a4c07bb816a3d76c80c6794b9b94ac950910e929b7fd4fb415cdda8c62

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
200KB

MD5
d3b9c5511ab4cd1dcdfbc959b42b86dd

SHA1
a05f74104eeeea295cb87edf11105467515aa95b

SHA256
cebdc0e673f4f00afb437a5d43b1ca0e1efb010f06b8955c5e1ecab494dbf302

SHA512
7d18bd18cca7600aea7f1c9bd9de550307212b4f332c910d8ec086b229da6d6dc74e094d561b36e168f6fbf4b46ff1f96dd5c51ce304d3cbc039f8a742a3b780

Download Submit
memory/116-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/116-1612-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download