06396390bc1a475df3b4ce7414fe53be0796da97420257a6fee9b19798d62a81

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4a1dd7688cf405e63486ae6bf1293f00N.exe
Size

41KB
MD5

4a1dd7688cf405e63486ae6bf1293f00
SHA1

f64ff7b01e77c60053b48ab0fc463a704bfcb9cc
SHA256

06396390bc1a475df3b4ce7414fe53be0796da97420257a6fee9b19798d62a81
SHA512

be7347d837f9f24d3c112c83adcb128d320eb4d027d069c16d3ab3ae4b6844c0c2d6941d75b8bdf45c3f432b88b9703d9e3de449b8e8a3f336884840ac9ff304
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBN10wpAp/lvolGClvolGwTCus7sczBD:W7BlpppARFbhbt7Y7wTCnBD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4672) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_elf.dll.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp	4a1dd7688cf405e63486ae6bf1293f00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4a1dd7688cf405e63486ae6bf1293f00N.exe

C:\Users\Admin\AppData\Local\Temp\4a1dd7688cf405e63486ae6bf1293f00N.exe
"C:\Users\Admin\AppData\Local\Temp\4a1dd7688cf405e63486ae6bf1293f00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
42KB

MD5
7782de72574bd58fdf1350e746e7444c

SHA1
e550d1b9712c6569e3253070a16fcd4b9902f013

SHA256
3b469ebb45b24ce58af2742d89a783b0ab8d5d9dcbc2c6ce97aaa6680b25543c

SHA512
f03ae95118694b6b0434b9edef0e833cd4ed002d8e37e96790244f53b81ebc3c25da92f4a7374fad445c8d361f13ea3e6d5d889ec5f0fe597cc7f48da64f4f57

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
140KB

MD5
595a909cbadeac2ac1b2edc3302aee54

SHA1
85664652ed202ad3f316b7582f8479d5aec15ea6

SHA256
da60b8854f4dd6149bbafa5cac363aad47f16fabbc4828878db11433171391c2

SHA512
7d65f49a4ebe7e6bdc759b0d2d2553eac45a131a1340aab6f386678adc7657eccda33a121d9724c4a5cd9f6ca14d31d31aa46a2552a3d40897ce7a9423937d0b

Download Submit