99eb8ab98e37b36d70ecca3feccc81e735e57fa79b66c32f7c279bd1f128b84b

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9fe4e8d9fcab739343bb05b132efa800N.exe
Size

37KB
MD5

9fe4e8d9fcab739343bb05b132efa800
SHA1

06e6730a1107b5a6646644007836ea888d2a819f
SHA256

99eb8ab98e37b36d70ecca3feccc81e735e57fa79b66c32f7c279bd1f128b84b
SHA512

ab1a23af43b7deeb3d5940c28cf66a65bd4baa79835d193869dfcc6f90309e5e5ad452344fc65bdbd8e81d288c62c23db4583097713ec24d5badf5756fda0312
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/Fzzwzscuc02J4uo2J4uj:/7BlpQpARFbhNIrJ44J46

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2491) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Google\Chrome\Application\debug.log.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.exe.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\sl.pak.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\release.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\zh-TW.pak.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	9fe4e8d9fcab739343bb05b132efa800N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9fe4e8d9fcab739343bb05b132efa800N.exe

C:\Users\Admin\AppData\Local\Temp\9fe4e8d9fcab739343bb05b132efa800N.exe
"C:\Users\Admin\AppData\Local\Temp\9fe4e8d9fcab739343bb05b132efa800N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-464762018-485119342-1613148473-1000\desktop.ini.tmp

Filesize
38KB

MD5
590c49ffe3c4f0da87b4800674380460

SHA1
253187fc186cfe28d3f3d98f90abdd3acb41f548

SHA256
7258dea06c5be3cb742a2508ea23b53e144f9f80c1a7fc998765c439a1e40d6d

SHA512
b1fbcde0bdec9441410fd9ed17c65065a4642a3c0c85013dccecc5b2fa2c0ce5f2d95a9902da809b5af5fd7dc5b3272412c6c94a7309a0ed04f9be55fab7d5e3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
137KB

MD5
a9681261bff9fb84a4378e159929c5e8

SHA1
7d7a8e1a4d11de97b1c4fb3cf82741e0b0cad543

SHA256
263d6da6d627039a0670463e01f2f735f2d768a618ed08743fcba4580d56b2b9

SHA512
a43c549b11ddf52bddccb8eeeb25db38970444323a8fcf3af2734854dd18da4a4f2eaa3ad80251da8aaf6074dfbef67bb12357835d2a4cd404dce93226a4b0f2

Download Submit
memory/896-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/896-1438-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download