933d4493e2e323d792156abfed2fb5ac0fb96f8ec591182f28fd6a726560645e

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f6a8fa8e2dbf28c633a9f503e792e40N.exe
Size

96KB
MD5

4f6a8fa8e2dbf28c633a9f503e792e40
SHA1

aa25be81e6593e87f0f002345f5db573697aa44f
SHA256

933d4493e2e323d792156abfed2fb5ac0fb96f8ec591182f28fd6a726560645e
SHA512

37c4c34e0f9f8469ebea130149974627abdab8aef921806a8c6234a0f11a0fc1d13dadc4490d14b13a0c0b710aeaa34c1a249167f5ed2ff9acfbdcb11d2db2e2
SSDEEP

1536:W7ZhA7pApH9QHwtRF9ESWu0SWutlggalggEpVp+ESIXosbosCUpCUpZ:6e7WpHIyRF9ESWu0SWuDmmSIjXp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4626) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\th.pak.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	4f6a8fa8e2dbf28c633a9f503e792e40N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f6a8fa8e2dbf28c633a9f503e792e40N.exe

C:\Users\Admin\AppData\Local\Temp\4f6a8fa8e2dbf28c633a9f503e792e40N.exe
"C:\Users\Admin\AppData\Local\Temp\4f6a8fa8e2dbf28c633a9f503e792e40N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
97KB

MD5
bce36fd0d6e37e5ab7538cab1fb13018

SHA1
4035c323f95692e2ca71aaef70af380a1284c737

SHA256
9a223d93cfa874047a44aa7a6f903d3df0475e0fc7f201cc0fc1cb0c0c67baf1

SHA512
558f71428bcb7923f0dd479e99a98254b0127694d808e397058cb8646519a4811cee4d1a51e92d9662bb646d3bb94659a237648bd0fd682fc0af90e8de470830

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
195KB

MD5
81c6fc912dcce57b92ec5b11833bd323

SHA1
dd5471a9853db571b30cac2872c938881551433f

SHA256
d46ca14ccc467ec428afb3ed00dea1c2ec294cb3623e4ff7cafc46918a7900a7

SHA512
e1e21911a42903f9832c6254b2ad34ff79c523ae688802bf54becfdb7a43f560e362cf8df70724aa0ffece297c06faf5921ccd1694724e8168766bafaa676c63

Download Submit