7a276c2b20da36a1a91fedf318f1f25b859d5ab09b76b5b1a0fa640505da3598

Analysis

max time kernel
119s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 20:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

501713204692c4fd7f7fe44d87754a20N.exe
Size

50KB
MD5

501713204692c4fd7f7fe44d87754a20
SHA1

cd9ba23f9523c91d107b0287f6e14c1e284678bd
SHA256

7a276c2b20da36a1a91fedf318f1f25b859d5ab09b76b5b1a0fa640505da3598
SHA512

9abb2fe93c0b932a64165799d8582c558b7942dd05867923fd09e2899e3f00014185b6ab4aed1b946f2cb7378daffa446253a05b3bf68c90b39ae4d2f55c3aa1
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw70EXBwzEXBwVX:W7ZppAppX

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2529) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\af.pak.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsBase.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\en-GB.pak.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\LICENSE.txt.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\SmallLogoBeta.png.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\MEIPreload\manifest.json.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ml.pak.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	501713204692c4fd7f7fe44d87754a20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	501713204692c4fd7f7fe44d87754a20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	501713204692c4fd7f7fe44d87754a20N.exe

C:\Users\Admin\AppData\Local\Temp\501713204692c4fd7f7fe44d87754a20N.exe
"C:\Users\Admin\AppData\Local\Temp\501713204692c4fd7f7fe44d87754a20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
50KB

MD5
f1da51a60b14d6e6c5bf5b112b72b541

SHA1
2229b300934eeaa2771784f9ed9293aafa6c324e

SHA256
9e650625451017e8b791c174e88eeead72cbf02a2a6e891fbdce17b3b8c20d50

SHA512
d5836c54c7eef860cf119dd228d95d3e0d9489a4abe37b0faed7983c4796c811f239919396461eee4dab23bec9c3f1650de1475caa24e7d207408025b5b63615

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
998453fc8f01453589e25c41f5fee4da

SHA1
04772c720ab5895156928a5c09c7707ad167fc6f

SHA256
2b03fd7052c678ee9fedab99d4974e81c6bdfcf8f6bb8d41c9413ca79e151ddd

SHA512
ea2d4647c205b3c87598c82c2f9a23a5ec27e210d6870975f302800965104964668808b1a3f08c49574900911c63c0d1667f4490fc795e9478c3adff2223b31d

Download Submit