fd5162eb26dfb722809eb3ccd15869aabad60289844419b0e10bd305026f613e

Analysis

max time kernel
120s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0da59b0f58cb676bb836d0b1c6300040N.exe
Size

37KB
MD5

0da59b0f58cb676bb836d0b1c6300040
SHA1

dc1b5b003485bb6367db3b040f46659a2631e54b
SHA256

fd5162eb26dfb722809eb3ccd15869aabad60289844419b0e10bd305026f613e
SHA512

69c5e3565434314a6305ff014982c882a206c433b58ca07f418ef4ef8032f06d5f23aa5ec796484f6bb1a4c76b4a7d48aa9ccc545092e431885906d6550d9e74
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxjM1GM2kS0Ie1Gg:yBs7Br5xjL8AgA71Fbhv/F70U07

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1758) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\GetClear.mov.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	0da59b0f58cb676bb836d0b1c6300040N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0da59b0f58cb676bb836d0b1c6300040N.exe

C:\Users\Admin\AppData\Local\Temp\0da59b0f58cb676bb836d0b1c6300040N.exe
"C:\Users\Admin\AppData\Local\Temp\0da59b0f58cb676bb836d0b1c6300040N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1403246978-718555486-3105247137-1000\desktop.ini.tmp

Filesize
37KB

MD5
bc8eb8d2106a2076fa5eb12ae48c7979

SHA1
eeb1b5d2528d6da375eedd5dd92c4c0d2d627d90

SHA256
980c5888a19e79707e3fb73659078ef5d01fde51643ec9a6f1f0b981932170da

SHA512
62cd975af3ac4858159784535ee0c4210b8be659a54898537ba65e4db46bb559f25f45847fda386f987eed69bce112c78edcc31f62712d4d787efab6a176371c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
8a5eb17c758e773f4a972ba913795eb6

SHA1
e6cbd904fc9d3523ea2fd9cd8e153fdab76f7d46

SHA256
c751d0924f25afc09964d46be960226f89a0acf1b20aed8d4f7c4204ffbd8142

SHA512
84c4fcef07c2dda92f7625d76da8c4e46172645a294db80b066cdcb62a32cadc893c13e93e601db01f5d5b7e820f93efa5dfe371cafb424f1418e2dc83311014

Download Submit
memory/3628-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3628-1122-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download