a455e30fac4b7c035b5c8573e6790b8aa52373bf3dd9dd8bbf8ad080ba6f6735

Analysis

max time kernel
120s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0782ca9cd4f0c64bb76c603c9db10ed0N.exe
Size

45KB
MD5

0782ca9cd4f0c64bb76c603c9db10ed0
SHA1

80387ee939e23cd7e121b884651833077ced6c9f
SHA256

a455e30fac4b7c035b5c8573e6790b8aa52373bf3dd9dd8bbf8ad080ba6f6735
SHA512

5a509548339d5995e21ce6a440f6d61bd2cc699e1a4942b385aef1e1a3c95e57863e2b1ff7b335740a87e65f93e01b3e9a7849e1c0e268d33485ef4f3fe4a6a4
SSDEEP

384:yBs7Br5xjL8AgA71FbhvlcLclzwzKR5hrM1z4R5hrM1zs:/7BlpQpARFbh6g1IKR5hrxR5hrd

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4634) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.exe.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Crashpad\metadata.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\calendars.properties.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\LogoCanary.png.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp	0782ca9cd4f0c64bb76c603c9db10ed0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0782ca9cd4f0c64bb76c603c9db10ed0N.exe

C:\Users\Admin\AppData\Local\Temp\0782ca9cd4f0c64bb76c603c9db10ed0N.exe
"C:\Users\Admin\AppData\Local\Temp\0782ca9cd4f0c64bb76c603c9db10ed0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
45KB

MD5
d5e75f10114666cb2afecab77c238ef6

SHA1
4f01d4411bd39ef22e89c78d2e2fa795e11825cf

SHA256
339fc97508bfb401b0983f1de50f2f12dca558e8125428a0ca8da39fdc66a449

SHA512
95fb95a25749371dca658c1e1423d10ea8dfb84d122cec64b6e04ebaf4cfddb6b8402d37ee019938031a82d25ea46822bef03786645e63ee07193811a8b311fe

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
c19d018e2f591008fd1ee60154b1df1b

SHA1
f3d49eaf6770f75b8d25606c0db8a6a03c4660ea

SHA256
c462c2969a8645b7f406ba5af501c29d524a50b9498c3077985d44a6009805fa

SHA512
34bb29b5ed3bc4957cb7c71c9b094b3dea07aa08c0a0590f8119358baa956e88bb5b5aba77bfebe795a134272a5a4906f5dc5cc53d9ab884ce39f15b8d98486f

Download Submit
memory/3452-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3452-1868-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download