4ab553b21140a881e21979055b95fba01705260b86bcdd4f761439543c7f6954

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d039dc9dd993139859466edd3f467490N.exe
Size

213KB
MD5

d039dc9dd993139859466edd3f467490
SHA1

71d031cdf0e817037b338084d4ed21afa1423fb5
SHA256

4ab553b21140a881e21979055b95fba01705260b86bcdd4f761439543c7f6954
SHA512

c590d4cc2bc88f7bfac47ae7e3c7f93d020048e40ecbeeacca5122379e7980f9aa962d2c4d6e243ad4e073925ae5b738f3c2059a64fbdea8c0d95cc18c89e67c
SSDEEP

6144:RqKB+tOkWKR0nQjgejWQitNt0W0HeC2xl:vlQ0eup0RHQr

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4145) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\he.pak.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	d039dc9dd993139859466edd3f467490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	d039dc9dd993139859466edd3f467490N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d039dc9dd993139859466edd3f467490N.exe

C:\Users\Admin\AppData\Local\Temp\d039dc9dd993139859466edd3f467490N.exe
"C:\Users\Admin\AppData\Local\Temp\d039dc9dd993139859466edd3f467490N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
213KB

MD5
54aa67e82f9988a536f23e98609e287f

SHA1
9680453a511f5befac1be6d26b98d027e0a4ba8a

SHA256
c9fff7c2f61a31b6fa107ce938adfc9d4d3db3e9b4cc8db1de6d272a6cc2d795

SHA512
889cd661c92cdae9981087e2e882abf0bf4c8ad4f5fafeb861f44bc9de6c8b36a25ee48540e8dc5099fb06f0fdedc708166709c95c83dcafca370f8d16c60df6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
312KB

MD5
3315a2f318859b4a5935072b618f3c89

SHA1
c5075168e9bbe9d77c95831d080aef197f807797

SHA256
cd86e23efe9b16d34749665351ec0d7a0bf4c74243d3ffebf07339f317c37457

SHA512
519e7e4f29dcdce8181728a7be6b29b1bc2a8c1b0865ebb6785b73fe097a7383ed7140b96eac90e7317b74b455644332ef031c31646ff229a926df92cbfa2b6b

Download Submit