c17d43443adc03299a39153b028848ee67baffb67f7276b8c27cc4c2b8284124

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
Size

51KB
MD5

4ffd43f2628cca9d4f21a0dbcf89bcb0
SHA1

b9ef18ef18fd2c5e441bb817284d23f9dfe1378c
SHA256

c17d43443adc03299a39153b028848ee67baffb67f7276b8c27cc4c2b8284124
SHA512

00185d9589d032b6b3a6c8889697c2eda2aef17a2330fa8e725320c56a9f7c4f521a34c35c91bf647322637bbe7ad2ac0fefa1741244c55ae882507766bc3874
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFew/DbAGw/DbAvnscNocN7:W7ZppApBULcfpHLcfpyDoAvnscCcZ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4649) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\am.pak.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ja.pak.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe

C:\Users\Admin\AppData\Local\Temp\4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
"C:\Users\Admin\AppData\Local\Temp\4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-113082768-653872390-2867000172-1000\desktop.ini.tmp

Filesize
51KB

MD5
e7342fae92f51b05816f8a8b2aa0abac

SHA1
303ba2b3c5576882d9237737d7fea0b838d6f380

SHA256
df348fd904176eb9af098f0fd6f33e7e483b498ce0114940caf830c1c24f6cd0

SHA512
945c18a5b6f71d818e905c41fbff47d0f1135ae01c5e5b5db48355c517c10dcae82267024f28e918aedd67ffa2987ac169bab8265766f0f87751ea553f2aa7a1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
abe0e28d676d2c4721eb53bf947506af

SHA1
895c239bef51640df5295d19724fe51746273612

SHA256
8158f028df9247461dea493e1228f2aac40547537ace40679cf77bfafb5a3f67

SHA512
da81919237757479f702c71c056e4f0721f6288ba247beb67fd0afdf89fca7bc42b922bc5f4e335556377378ffc33fbcde6b8a5d23116818e4c9cddebeb4e4e0

Download Submit