9ad57c5be5c7c718ad16c3f389ab2ad2394246733563862eaf3e281934530fc9

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08e9dd8c73ce5b2a1195197d2df5d240N.exe
Size

100KB
MD5

08e9dd8c73ce5b2a1195197d2df5d240
SHA1

ae59c90ba82de1ee027051fd39bcb9cd4fdf0586
SHA256

9ad57c5be5c7c718ad16c3f389ab2ad2394246733563862eaf3e281934530fc9
SHA512

f28f7acca296084fae6164cc839131394be7e835636c0ba183fc680fb5c41a00ebb39725b52ad8b4b2052f17e33a4ea3524c93ed3590ab66a11bbcecf593c9da
SSDEEP

1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/8z3ML3+5:6DWpwE7oL2e+efZwZ08i8z3MLW

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4374) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	08e9dd8c73ce5b2a1195197d2df5d240N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08e9dd8c73ce5b2a1195197d2df5d240N.exe

C:\Users\Admin\AppData\Local\Temp\08e9dd8c73ce5b2a1195197d2df5d240N.exe
"C:\Users\Admin\AppData\Local\Temp\08e9dd8c73ce5b2a1195197d2df5d240N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
100KB

MD5
0b6511893a0092bc5bce68867b7e7283

SHA1
f1035eaee21195fb1efdc9a8f2dc5847b774e84a

SHA256
07e2ba975e77c73e12728c07d1f4beb404c55418f3ea5156c97031df94d8b814

SHA512
6c28f598ef215f15bd9bb057bc96c1bad8c79fcea1376510cff5da1a119dc360709fdc535c8587d81f43544b9594015f2335dcb25b01056f82b6471252aedfe0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
199KB

MD5
3e5b1294f5f1c1453766ca37fe051fce

SHA1
8128c87c8d58c45461fce15c37829b3817e7d915

SHA256
cf1ec2f0973f41004890ed3d81b271934df49c2c71638bad994d1095a136c7c0

SHA512
758de0683f90f72c21e47b36aa9d3c03339deb4996ae409bef404059d29c0409fc555f947c306d8aa6a6a676f413c641dd1f8560f2bb0721c6eb9ea77a2caf94

Download Submit