1fa8fdd3f276b62f3d7718c1ba41eec93ad10ee41760b0ad5dff9f9bc8b4e57f

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9327db44bc586acc90f3bf7d931889a0N.exe
Size

60KB
MD5

9327db44bc586acc90f3bf7d931889a0
SHA1

7bf75d5075cb6d199ad1db0e6e1dea7ef88a70ea
SHA256

1fa8fdd3f276b62f3d7718c1ba41eec93ad10ee41760b0ad5dff9f9bc8b4e57f
SHA512

9389b06b4553ed1b9bd4aedef4e7f1d16ac58ed05c98108e57145f47d6309269039adf85d4c6f4701d53c94f006ee6180f9f214fe9f835d969f86e3a99ba54d8
SSDEEP

768:W7BlpNLpARFbhblkYlkuvIYFdJSpXeXUgo0xOyyiJfo0xOyyiJ/:W7ZNLpApCZuvIYXJSpXeXUEb5

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\DisableAdd.au3.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClient.resources.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\gu.pak.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicudt53_64.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.tmp	9327db44bc586acc90f3bf7d931889a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	9327db44bc586acc90f3bf7d931889a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9327db44bc586acc90f3bf7d931889a0N.exe

C:\Users\Admin\AppData\Local\Temp\9327db44bc586acc90f3bf7d931889a0N.exe
"C:\Users\Admin\AppData\Local\Temp\9327db44bc586acc90f3bf7d931889a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
61KB

MD5
79b88a53b9cf26efc8d23b64f94b7947

SHA1
4615a036838bb3d9f41c341550a6b0e1ed9531ae

SHA256
409537a0a78ff6fcc6a74984ab721133291dded7c72f02701f92492015eea10b

SHA512
09f7e1ee38f8380902edd7c8f9fa4df08531b9d5071312bd898ce978268fe94f51cbae9b5470a6fa71ac7e19768aace7da4c0dc8ac1e0c8ea7f34e2730ed067f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
159KB

MD5
e1a22ff0fd00e6cd8e30258f66d4cf7f

SHA1
015541b34e6eabc6d32274621af5f13616363a78

SHA256
1a63cb39c822f128eb29e571ea06e82bfa1a40e47ec0fadce7710e90e82a8e2c

SHA512
74080551fc6056765e533c0251014618631a9ca36651ff112fb03ef7cf0309033d774cac96decad75ea76ee17dff35b7c278db5fb0234ead9bb25ac139145bbd

Download Submit