ef3cb958d895f5bfb8ef5ee697a06b3510dc39afb606679ca0490a38114f5130

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9344415643eff0e5ffb1e7acbdf5ad90N.exe
Size

100KB
MD5

9344415643eff0e5ffb1e7acbdf5ad90
SHA1

f7b56b5fa8db6c66977ac26c4c32cbd6965f3578
SHA256

ef3cb958d895f5bfb8ef5ee697a06b3510dc39afb606679ca0490a38114f5130
SHA512

6902add7e9400d8d64a3eb26a428ba1d7748af9da87f3bb8d8b52c66124d0227898b5edadf041fbbc468cd01d67a61426c62b327ba9e5b3828fb7ef29c6a3b3d
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXa39:RqKvb0CYJ973e+eKZ0VI

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4325) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\MergeProtect.tiff.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClient.resources.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9344415643eff0e5ffb1e7acbdf5ad90N.exe

C:\Users\Admin\AppData\Local\Temp\9344415643eff0e5ffb1e7acbdf5ad90N.exe
"C:\Users\Admin\AppData\Local\Temp\9344415643eff0e5ffb1e7acbdf5ad90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-857544305-989156968-2929034274-1000\desktop.ini.tmp

Filesize
100KB

MD5
6321cb8ebd777228d2220ff9adb473ac

SHA1
ed955962bc9a85d8412da2d4a853792ae5c808c1

SHA256
85b0437a930b5d1049f5b0ef9127f2330856bfbda058fd79f2b87c2619e21687

SHA512
d8dc0cb0eb4afb7c8c9360a1d25c7252fc2ade71b9b38a848a34eb66606fdc783ed1f1476008084039630fa6ccda25acce3faa59c5cfc63ee7053caec9a87211

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
199KB

MD5
ef030c76462a4539666f62d42edc553c

SHA1
a7e7bc0d4b63a2191f1f370db73c5a125a120641

SHA256
621b680fde4f06e14d9bfaa7c371d260cb9c6b31ea6455b9a92ef73610866ef9

SHA512
22179b26c6ac2a4dea7f880cf102efcecaeba55a08c1b001e87bc4f5923eb94d12ce7500e3adda58713f2f4476e8bf9d3096bd74d2cc6edfefc549ffc13dc92e

Download Submit