cb4f0fed84a97af0b1c1ae49bda30e213ac23a1e22f3af76e15e026bb11995e8

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
Size

41KB
MD5

6ad4dd1a1f9b560151dbc908f0d82ab0
SHA1

162c58c3bf74ff2bd10b2e3af6e7b2f91736f44d
SHA256

cb4f0fed84a97af0b1c1ae49bda30e213ac23a1e22f3af76e15e026bb11995e8
SHA512

a781b4ab986c383a48e478bd88bdb4c301a129f1f0d943d838ee8f66e6e271e297c50b118ce17c011a922f72ac66aaed3a4103a04e85fb11528de103748e3cc6
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FzzwzAQNWQNY:/7BlpQpARFbhNIT9Y

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4723) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\DisconnectStop.au3.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ad4dd1a1f9b560151dbc908f0d82ab0N.exe

C:\Users\Admin\AppData\Local\Temp\6ad4dd1a1f9b560151dbc908f0d82ab0N.exe
"C:\Users\Admin\AppData\Local\Temp\6ad4dd1a1f9b560151dbc908f0d82ab0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
41KB

MD5
3a4c2f190024a9e5681121d88780fc37

SHA1
005195810c8f006aab445d45d30d6ef938249379

SHA256
fa3cebbb37e496c3bc1fa8c351eb2b19822b4c25d0e891cdcc569d3a28b419ec

SHA512
1a0ae8fa46b826dfddb13eab100540ce0f2432836b5e1f5fd19c8b60c12bf5563ee80e6cdfab70b064a1535cdf788d1ee4e268815c596f542b9be07f18cfcf5e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
140KB

MD5
f4edefbc840dcea13a957d3bf3d70bc1

SHA1
49f7df6b8702be79f796335e9485f7cdb793c4dc

SHA256
012a3075f5dad73f2ce97754733f548ec148a2aea67a935be8ae226bf12fd30a

SHA512
f0ce056465e7b6b4772c85e05acc74a0640ef0e27048fc9b8dc2be93ec56957a723f40866ed6dd86effaab5242cf4f1938bc773010917ab9ccb27b6632e0ff50

Download Submit
memory/2168-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2168-2008-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download