fcdb183ac42b2beedac538df10e24f44dd420133d51be58c9097546f9f7a54d3

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d6fd11cf63983a3aae71d7e46ed6660N.exe
Size

238KB
MD5

7d6fd11cf63983a3aae71d7e46ed6660
SHA1

4e1a33ae5197b9a17a030ddaac752d1fce80433e
SHA256

fcdb183ac42b2beedac538df10e24f44dd420133d51be58c9097546f9f7a54d3
SHA512

b2910a7f602c94841f8926edf9a0e20f74300f5777f94fc8046b3f3cded397849b7b143c6fad43a94b4a54153d9698c325859a8eda9bc9c019bdf2ef055d3a56
SSDEEP

6144:RqlIyFESWu0SWuGSCLzawPS/V9tanWsx298Yfi0F2Zo/:tyFv2I

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3743) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jre-1.8\bin\management.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp	7d6fd11cf63983a3aae71d7e46ed6660N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d6fd11cf63983a3aae71d7e46ed6660N.exe

C:\Users\Admin\AppData\Local\Temp\7d6fd11cf63983a3aae71d7e46ed6660N.exe
"C:\Users\Admin\AppData\Local\Temp\7d6fd11cf63983a3aae71d7e46ed6660N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
239KB

MD5
68590f1cbed84b82be867bf0d9cf343f

SHA1
e71e6f5ff97fd624647fb71246c7c70d70c90777

SHA256
bd731317c7df16d27913b19175198a08d4591ff0e9277cb07c077a7e9cf93411

SHA512
9314a9d968c47846984e4c8bb9eff1db2f37a463c2127433f4c22733df4df5174ff21aa605512577b3f1e8a6110f76a9af2bb06ccd401e3d9bbf2ed1c3e78a5c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
338KB

MD5
32602ea2e0039e334f01a0647ef5efde

SHA1
cca009d708271731deeeca1803dbb89b32a13c87

SHA256
72c659190fb9aa8069eeb7c791fed3058a71ffa667d53614df9ee8566c322c24

SHA512
0734fcf6c5f5811f887d53f061617fa7fef2fc958ea8d2221536634d837c9bf41e067bbcc4acb8ed48a9fea72e1bc383e44d2e692aa37f0844801ce5679714c8

Download Submit