474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
Size

59KB
MD5

7bae97f9b9df4b2883178a152b4746ea
SHA1

ea8ef3abd1653df2ad98a57010497326f6e973ca
SHA256

474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1
SHA512

86bdbcf18141372d7de10194a0f3dba787c0e4dfc0150323589fa1429bbd0781de4ee375dfa6f82e95261fbca18e80bed2c082fef3a697504943fb1157f679b8
SSDEEP

1536:W7ZNLpApCZuvIYXxJ75sNpJJ75sNpyPIXxXl:6NLWpCZLYFXxXl

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2303) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\bg.pak.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\fa.pak.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe

C:\Users\Admin\AppData\Local\Temp\474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe
"C:\Users\Admin\AppData\Local\Temp\474430d2bca02e948ae805549afe6a7b2fe0b11b1d307e32be5be0aee6a8b7c1.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
59KB

MD5
a2aaf1ad395248d9982c1be483522a38

SHA1
a8f3a3b8866a0b77e800c4bbb983bec28046c1f4

SHA256
2fdd6c1f8b53fc11bd828f6d1fd2080bd1c45f3adf033ef5c92f47386e483eec

SHA512
b590afcd1335b41b7735165ac1832ea8aed503375a883f350ac49a0bd623e6b679d68cb2cd7343a0dbb41d7408d84743f34b010efa906466122f63da9bf55e1b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
158KB

MD5
b31ac0d388e5b6bc12b464ff5ee2fd24

SHA1
56f7a301eab8c19deead0673d502127c34bde68c

SHA256
7cdb5a8cf8e3017411b45c2acdc353d666b77e821f46d44a48377f9a7b1caeb5

SHA512
ade7ced5bc49dd6e2febeea7ce18be7f9763be12ef3687652c3cd9f51fc6e8df119127350586c1ee57c2ff86322df09d183dcf317db7e0ad3d5549215d16e0d5

Download Submit