9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
Size

60KB
MD5

1014b8fccb3335ddc3a8c76a58ffbe8b
SHA1

21531904ca3e52bb292fb9bf21b627abf31b0176
SHA256

9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e
SHA512

de821e2b4859cbfea9e10fa9048e69d41ff41d2f042b2252733dd4638ffe849d7ef65c608ee12d097b95f920ffe1572f53ba9f74732b0ca4ad4d76df8e17048c
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/9Oq:W7ZppApBULcfpHLcfpX2/Nw/NwmxS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5112) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OIMG.DLL.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.boot.tree.dat.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe

C:\Users\Admin\AppData\Local\Temp\9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe
"C:\Users\Admin\AppData\Local\Temp\9a6d86923cbf92817c9f814f8c5eb125e12ec07c6b0b24ea7f2c9beb3983775e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
61KB

MD5
80368a6aa597d72a9cd789b89e092908

SHA1
1f08b723c7f05d421feb20475d8b727f8fc2c2d7

SHA256
b84ffbbc3f2f5e692565d3353783fa48583cf6f010a80459a3fe65ad40daee6e

SHA512
95967997a812b4cf1f69133bfdce1cce364a18b0ce02df88476cb95b561ee805b220ee40cdb126e7e57972eb91763ddd95d9237ebae2543c7c38cc112f7ce3b6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
159KB

MD5
4feed692ab5d1c4eecc2ea31832d1778

SHA1
9fbceb47a6bbe3e282f96b6b9f2b4d8277ee407d

SHA256
43ed867e54eb121c7384182a64539de805858d5104baab55e2b18e3e628c9fe2

SHA512
68731adff61d4a487f4cbfc95890a9392d2be6585f62da8e3ff1028c99232151fbf1c1fe5f94c37ee437f93e3df2beca8f4109b5b3dc2ef44ac529b64094ef37

Download Submit