93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148

Analysis

max time kernel
149s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
Size

80KB
MD5

3e356485b739a05cb02691b07ae34c9b
SHA1

042d9b61c6e2258d26e58b6b7679a82e1ec9d96f
SHA256

93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148
SHA512

4af60cc50f913f9b37dd342233fd36144ed1fd1866ff288e1e009a86d519a78b7c3073a39190fe78fd4903ac2b4d00970b3e031590df0bf50184e51c13d5a244
SSDEEP

1536:W7Z+pApfGQ3y3RWvfmRfm9sKsSd5GT6Ssn:6+WpDfmRfmh2TSn

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5206) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.boot.tree.dat.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.tree.dat.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\catalog.json.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.tree.dat.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe

C:\Users\Admin\AppData\Local\Temp\93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
"C:\Users\Admin\AppData\Local\Temp\93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
80KB

MD5
d5c1cadfc8e62e69e89f69ca0fb62b85

SHA1
7d4c701fe3b488debd3ad4bcf4b398a55da6654c

SHA256
7d7a9cd55667d87650baa621824d5e2f9863f0ddde76ed23ebebd351c5ebfb73

SHA512
024599be73a499b2892ef6a04195419f73e29d08901c1b42afa742a85b08a136f00a327d98da966c11f8b9c3045d7fc25ff3517b9d39c32ae3dda28d9fcedc8a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
4149da03f18cd4eb272d67d568053c0f

SHA1
72350a83848276f25d1b36246d3ebf755b0df11a

SHA256
a7f29bd470185a0c7066434d9692efe81fcf1bc41d8274b6613288a8d9b525e2

SHA512
81e1c47bee0eab5c4b3d8ab41cea9b60e768bf2fa9abe1dfd200f39d718cf5ee0e0ee582ab844d607f3e4831502019f490978c4546247193aa01d0ade19f550b

Download Submit