6918ad93d90d7de8d75d53c2e7975a76e8a6636770ac4f53d2db82a70280bca7

Analysis

max time kernel
120s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1714d9cd83280251d65ab0597f3d5d70N.exe
Size

34KB
MD5

1714d9cd83280251d65ab0597f3d5d70
SHA1

051af99f72c657f7ee5eeda2b9dc673de181e97e
SHA256

6918ad93d90d7de8d75d53c2e7975a76e8a6636770ac4f53d2db82a70280bca7
SHA512

0c99849e9664a5d2b2ad5230ce73decdf31978cc067f15c8b31fe2ba5bc34663abfda0df31ce64e85c690374c02d758ce005306179e828ec2a0f2e56b51a6156
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FRojeOiJfojeOiJT:/7BlpQpARFbhjojeOiJfojeOiJT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1613) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationFramework.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp	1714d9cd83280251d65ab0597f3d5d70N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1714d9cd83280251d65ab0597f3d5d70N.exe

C:\Users\Admin\AppData\Local\Temp\1714d9cd83280251d65ab0597f3d5d70N.exe
"C:\Users\Admin\AppData\Local\Temp\1714d9cd83280251d65ab0597f3d5d70N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini.tmp

Filesize
34KB

MD5
a436cfc18e5aa8d9588cae32e06941f3

SHA1
698e3d221c70ddf01d2b9472a12709f3be336f45

SHA256
cce610a2dcde74158137a3d390d7df2cc962ff299d32f5192c532455659b88a7

SHA512
43acb3002916b0ba75733b6384b3ad879c43561c83c44af86495e135336f195d353e5e430b4e6ad7aafdc046912a42d8974ff5270a847f74b0928010fef3f2c6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
133KB

MD5
cf89f87fae6a9aca1834049e145b89ac

SHA1
f1520053a605976ede93b359c97c9a590ab56b79

SHA256
28a0d984e2b5e09b2fe2005caf17c788f074213335f77a1f7d39228ac2be81ce

SHA512
4468e1caf1af9a06405534e55c034ccae1cab4908f3d2419adc9e154b93c34de5e42d6f21998f7247aa0bb694af99fe591e88ecff20420106f8c632f722d0b98

Download Submit
memory/4044-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4044-908-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download