a1b3b9e3567913c186303c2958c7c14d2fd92f90388ff83878669510b1f77153

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0a9d059043aac9bcc3cd2bbf30c6b920N.exe
Size

51KB
MD5

0a9d059043aac9bcc3cd2bbf30c6b920
SHA1

154a1354bb6ff336e9fecf8c2bde7af92fabca24
SHA256

a1b3b9e3567913c186303c2958c7c14d2fd92f90388ff83878669510b1f77153
SHA512

a01b2a7cce3597030fcf1bd667c97cc714bfdfb63d0fcf5d05395bdb49604ed06b9adafc6861014e00a9e109ed4b06c12a734eeee1772611473d8f86c4976391
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNKVkVYlIAItCCIntkntV/r:W7BlpppARFbhFAxC7ntkntV/r

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4627) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	0a9d059043aac9bcc3cd2bbf30c6b920N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a9d059043aac9bcc3cd2bbf30c6b920N.exe

C:\Users\Admin\AppData\Local\Temp\0a9d059043aac9bcc3cd2bbf30c6b920N.exe
"C:\Users\Admin\AppData\Local\Temp\0a9d059043aac9bcc3cd2bbf30c6b920N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
51KB

MD5
352dea5892d5a9980dca7c09a58bc114

SHA1
eb28981934d227ba4835e955c1a37a0b1e550108

SHA256
26dcbe69714ab998361f149f596d67416d8fb0910610d8ce8ad0f7b4ee2fbd5c

SHA512
9c72baea82a19fca06d2b6ad19f764e0fabbcd6f004e2ce3d7625181ab3f2f040a4995c6f53d787a6154419565cec763cdb2f3beba6c0934a2985f17d4cbaefd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
e475676810a25b7429bde900277b633a

SHA1
e218d411f7953c10223cef1fc07e7685c36ab9cc

SHA256
2f3ce804cef5c1913e3c3e3d479db77c47ec64bfd957808c70f1c11d8119fe56

SHA512
7b77fd64ae2114642e24f33401053649fa3d1b29012edb968d7907ba63ff43d241d19b5ec9d7696fa9a2cdce7b520d1f5f02102c325ed560963e6c46b73c7726

Download Submit