da86dc76e1068a673c4bd361d49f302d3378efd42143528f890323750e704bc8

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06a2100de89527142cc02e767d729c90N.exe
Size

42KB
MD5

06a2100de89527142cc02e767d729c90
SHA1

5a8319cf4bf1a18667da13be2b68ff06a2f67681
SHA256

da86dc76e1068a673c4bd361d49f302d3378efd42143528f890323750e704bc8
SHA512

3f04a4c67df467b9eb4db3ca8086d0aff04b942f82b9a2d345f335f931ec1c1c74e70c16c481d3a8d83b45dd8b6a18548f70d6e90a7790965687ba12769b1bb1
SSDEEP

768:/7BlpQpARFbhn54fmiy+3BVr54fmiy+3BVH:/7ZQpApmiH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2434) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\vi.pak.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ml.pak.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	06a2100de89527142cc02e767d729c90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	06a2100de89527142cc02e767d729c90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06a2100de89527142cc02e767d729c90N.exe

C:\Users\Admin\AppData\Local\Temp\06a2100de89527142cc02e767d729c90N.exe
"C:\Users\Admin\AppData\Local\Temp\06a2100de89527142cc02e767d729c90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.tmp

Filesize
42KB

MD5
caa84b1982503dab60080a0e919848ae

SHA1
01340e1d463f6efc50ec6a8589790aa973e7f9ec

SHA256
734d742dd9e12f9bed2102a2bfb9879d8ece636c25af567853098129a5a73a53

SHA512
76738b20b34f19367d351f0d5705056b0677447cca71e899aa300b61c0b77580a1f14062899f85d7b8b4016217cf706cac6f66d61b3ecc9695221987de6ac892

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
1f0835d0e3d05958197abe01f52557dd

SHA1
09841ef56bd71168ed419125899a4e42e2e6994c

SHA256
ea3ae305df6a38ff81beb5e5e707e752b9d80ab3539b7a54c1153bcb3b296ab0

SHA512
036b41d7790e51c41642f5456bb64abb9d31e715d3b2d1258f24d09fef2c4a363e39c9efd8ed1e7d5234c6ebdde3354d9fa39ee64c1b9327dfef646cc20f4c70

Download Submit
memory/2404-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2404-1548-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download