6b946a84f446141c28d404667a9930bca0a235fbe00f7cf296bd13f598fdf533

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

077cf1830ce7c5815bc4c17dcea3aea0N.exe
Size

32KB
MD5

077cf1830ce7c5815bc4c17dcea3aea0
SHA1

b89f98873f09acc1de997b5207e5e36a979cb245
SHA256

6b946a84f446141c28d404667a9930bca0a235fbe00f7cf296bd13f598fdf533
SHA512

f4e6bd9b04b71cc51bda0eb334a6aff987a1c2116d32717d73e5bb498af227cd025793eef66cafece2c51aea6eff69ebe92afde160ec989297c248014b7ab493
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxjH:yBs7Br5xjL8AgA71Fbhv/FH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2329) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\af.pak.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	077cf1830ce7c5815bc4c17dcea3aea0N.exe

C:\Users\Admin\AppData\Local\Temp\077cf1830ce7c5815bc4c17dcea3aea0N.exe
"C:\Users\Admin\AppData\Local\Temp\077cf1830ce7c5815bc4c17dcea3aea0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-464762018-485119342-1613148473-1000\desktop.ini.tmp

Filesize
33KB

MD5
33068003ebfb3b05b478d8d92b5b18dd

SHA1
58dcae48f76197fcca9656413be4561bf3b17641

SHA256
a98d42fa701b1f5eda68e6c154c8a713f429a8c349563f3ca722c70311574229

SHA512
0aea4a8fa272ce6020b259d595cd368b461eed342c5035bf9d895a3c73321c32456f1f66e3e55ac2c5c449de1b0d2e746b30b989f6b42b390551328074b06ebc

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
131KB

MD5
87cb58d89ceaa583966dc19f49539754

SHA1
a01a3fba8f9f13bfd16eb9cd3ef59e641015fc36

SHA256
3f81d54f978d4bef9a358b906f996ce6301b798e1dd4af6e009eac9de5452853

SHA512
1efc686ee224bec41878a6ce8b6e522ddc227dd5713d2b12555c16f0a88d6d24727b17c781482db60443f905b9f00988afd21a7be1daefc13bdf8d6b46d6c5e3

Download Submit
memory/3572-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3572-1428-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download