fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
Size

48KB
MD5

8de5f75f6495d590ac9f8a22c32d8553
SHA1

91684f7c8eb76687110c80378b56c7379601735c
SHA256

fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b
SHA512

2adfbe8557b11f3b3ea0822121e68527375b8a585870e1a96316f5daa4903136ec73d85a9f640bdd6188cc0658e67b78f6e8cec6d383f2c8bc67ea08eda7382e
SSDEEP

768:W7BlpppARFbhbt7Y7wTCg0hcM0hcOwARJCrAdJyxB1AXJyx7wARJCrAdJyxB1AX5:W7ZppApN0hcM0hcZ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONFILTER.DLL.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAME.DLL.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe

C:\Users\Admin\AppData\Local\Temp\fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe
"C:\Users\Admin\AppData\Local\Temp\fcd97bfbd1782985ed9d8f7cbb55ffbf5840f2e6e03ee18723cb5863cc997f1b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
48KB

MD5
5a2ee4ab3981b00274ec6836c8994400

SHA1
39f8cbb4a87a1878f8b84e02ee1d33f729760837

SHA256
ed46b14266ea13e5a7b6e1bd71da45b1d626ffab690f24aef228987f0f8ed945

SHA512
df8a351ab2e7af2e20db762f452d142cb97187f1ef1320873299e76c038299e646197a7acb3896ded8f8802fc7d8b6dfc667c576f983336f22301f9b8b937caa

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
5522c5e86d2a2dc5ebbd64379e0196e1

SHA1
bead3dccb9a372582509cebd5411409f59ab6077

SHA256
2a8c63f8528a578c8724a1f1a7a29b2ab7ea29d44236e5c3a9dad925fa0595d8

SHA512
21ffa6cc4d991723099b23bb4fad134ab6485bda2e3f284416b4688d2375136665fb6d8dd6c07e383678548c3a0122a929777c080a26bdbf502c6a592ec39b9d

Download Submit