c448d0b927837fa95a33aced941a00d32cbff6cf94fc630ff77520fd26d1b99f

Analysis

max time kernel
122s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

014aca964cb761998a4b96eb2747eef0N.exe
Size

50KB
MD5

014aca964cb761998a4b96eb2747eef0
SHA1

988d5722db17f35deee5e3e5f55c38b8b2ab3c86
SHA256

c448d0b927837fa95a33aced941a00d32cbff6cf94fc630ff77520fd26d1b99f
SHA512

c8994d3bd758a6ac6834ac389d8659767676d7fc72acf70305862745d0614a0a64a47566a22bd9d7bf8632317e625506ac976dd95c19e15a6a1db40ab67f353f
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNKVkVyicv1Hicv1bCYCcgqebNXgqebNw:W7BlpppARFbhFAyichicRPhgqeBgqe6

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2172) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\notification_helper.exe.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\da.pak.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClient.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\lt.pak.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp	014aca964cb761998a4b96eb2747eef0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\he.pak.tmp	014aca964cb761998a4b96eb2747eef0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	014aca964cb761998a4b96eb2747eef0N.exe

C:\Users\Admin\AppData\Local\Temp\014aca964cb761998a4b96eb2747eef0N.exe
"C:\Users\Admin\AppData\Local\Temp\014aca964cb761998a4b96eb2747eef0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
50KB

MD5
15498f2e80149693fdfc6c0844604bb1

SHA1
5bee019cbe15eca0e00515b638de128ece7650f1

SHA256
961bbf14d1a8d2b6c304b62633af34d59e61bfe7b8e191546812def4a1793969

SHA512
79df41d94271dec364b3f47e00959a84679592c012c523a534799b55a9ce08c89bad9e7679a888732b476e91e205da830817f0eb4e3b33caf208c0228b34d3a3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
d43bda373e26f060ef363e4c7789793e

SHA1
28a51051f3785cebefcf9117d34467157b4505c9

SHA256
2e90d46c903811c99d243f7380a03aab26b0fc8be00d7d41902a15f24705f837

SHA512
4ea64ad0f2aa5e2adbfd93efddc5da6cad3225aa3cf959b5a870760aa9405b9c17270807f860aab52a84ee7b4eedde2649d3b3a50e6b8646620c8670fc37c439

Download Submit