67c43e35eec4ce2dc0955e58a4dda14f77e1e5d9f3c4c968a2d954e0a968f8e6

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a40b6b04501add049ac2e8fd013d370N.exe
Size

60KB
MD5

9a40b6b04501add049ac2e8fd013d370
SHA1

f6aac05161b2e4650817358b53b7151e03290f47
SHA256

67c43e35eec4ce2dc0955e58a4dda14f77e1e5d9f3c4c968a2d954e0a968f8e6
SHA512

8803b9e0ac3b86a081d1d16dd71fed850f5394e30947b4b6b5da22b2e852a4693dd35cff7ee98ac17eb16723e789fda6d7a9c32ab52e526978c54312ad465953
SSDEEP

768:W7Blp2sspARFbhJpupZ5pZ4+fTgTvlK1lK6RZR+8/8gClurYClurgNw:W7Z2sspApkZrZ4+fU7lK1lKT8/8SNw

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\id.pak.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\GroupConfirm.dwfx.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_wer.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	9a40b6b04501add049ac2e8fd013d370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp	9a40b6b04501add049ac2e8fd013d370N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a40b6b04501add049ac2e8fd013d370N.exe

C:\Users\Admin\AppData\Local\Temp\9a40b6b04501add049ac2e8fd013d370N.exe
"C:\Users\Admin\AppData\Local\Temp\9a40b6b04501add049ac2e8fd013d370N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
60KB

MD5
0d495f7c1fe6c2d802ecb22d79ac43b0

SHA1
58ebea667fc5cee370b79cb48c41539a4d480f3a

SHA256
94e129f8676002a404d8f22e1e05e61884c09f8e33744721e281d4206720a514

SHA512
7060af46654caac9e921922460372aa55ea9090837ff0fbe965f66a6ba295896a1c04359de3bb5ba066badcbd8ee6747dfb1a7e0519bcf3b0273e259cfd65764

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
159KB

MD5
541d3b814cecd90f30e527a09f3bc581

SHA1
58dc6b86770622e8f86874bdff876be76ccd3df0

SHA256
bc4ac0babbf0ad88da5ed31dd5570c63d601a9c8486069f84c2a62a5c38aa876

SHA512
1efd4c53ad8204634bc379777f3e0ae218c0e361a6ca61fc4b93e89b3e59f06e61b67833ff8f287f22b36c532ec8a3fa228bb89d9205e3928584e1142812353e

Download Submit