5520a96fd9b21a7027483569335312328c4f1d882ebe006e6e0fa62cd09de9ed

Analysis

max time kernel
119s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
Size

74KB
MD5

dc1dfd5a734e2fcdd2e887154a3d42b0
SHA1

f192465f477a78c06d7ff7d11d8ec712f933d917
SHA256

5520a96fd9b21a7027483569335312328c4f1d882ebe006e6e0fa62cd09de9ed
SHA512

fa340b5436ea4eadb9ad5cc0bcb5c2eef21ba0d8e0aea52ea2328002ec57ac21bb07c6fadec19c531abef325033b9873a62a523ac6ca37585ca28fe32d3b91f5
SSDEEP

768:W7BlphA7pARFbhvOsTKnKqtb4HBZjlwGpCYnigugqOzM9bdifwMtxEwJjlVkUJ5:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjl1

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4660) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fa.pak.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc1dfd5a734e2fcdd2e887154a3d42b0N.exe

C:\Users\Admin\AppData\Local\Temp\dc1dfd5a734e2fcdd2e887154a3d42b0N.exe
"C:\Users\Admin\AppData\Local\Temp\dc1dfd5a734e2fcdd2e887154a3d42b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
74KB

MD5
a32a46114a9f400ea9ea6cb436e23d4e

SHA1
c30eb19f1f479fc2e70eea08ebe6dc106d123438

SHA256
2ee4790eacbd0d273aca4859762cbaf3c69952b18b0ccbcd6ec3a120bb2b0d24

SHA512
b9f06da34c965c8bdf89f111419a9d509054f046fcaac1871ad9e7757fc7ffd04f541fe02be384bad39f1ea23b5579c4b28cdd0f031f2b51ce10216d90e3b4ee

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
173KB

MD5
5d08beaa2af4a0e61837a84869c27bef

SHA1
ec4d266640507b2a145c1e727bfe44e0af35034b

SHA256
260e7828f15f1510fed979965d9fdfbe804e129f9aba36c479fcd1ebf83f4ec6

SHA512
a9ccd08867f451efd9623044cb9c5d243efb7f5dfd9a603f9c1e17d129595ecdc2d1fcf1504c27977f26e64d67de9530a9d0e5c3f4c98268f46c030b12b1a1dd

Download Submit