49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
Size

198KB
MD5

b8e0f9f97e599763a48745dafc5c7e23
SHA1

90cbcc80926653fdcf30d15f66487b6b9a3a4b85
SHA256

49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc
SHA512

926bc238d85a8ffd5f471444183d6bab0cc69204433eb29b3695b338964180c4f3017479e5dd5e5446f41f24957adc8fa039b952c1dba4a777ab7ab3a93b647d
SSDEEP

3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBJTzkQ:RqKB+tOkWKR0iJ0lTzkQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4660) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClient.resources.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe

C:\Users\Admin\AppData\Local\Temp\49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe
"C:\Users\Admin\AppData\Local\Temp\49f9f2b311ac723147121eb717fb998779674257791e2bbc871cbd3c458adcfc.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4156,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:8
1⤵
PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
198KB

MD5
fa683fc6ac9a7ec646126772c02e6cf7

SHA1
338c6f8469f682d6ad6b4ed032cbff1d646aa1cd

SHA256
2fa5abc1ee2c85249fc4c11959064715f35390e859cc4e743d085129ac91f19b

SHA512
8f4c7e8bf28bf94800c2aa55765c91ad4e8a1ca3900dd45f9c1a95175be36a8427c2a78f1415303d6e45107dcb05e351ce1f5d6b8cd22df6eee70433acdae9e4

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
311KB

MD5
d79397a178648026abc0de6a115ffb1d

SHA1
f4342cb9592cc546ab166dd2f68e2aefc1b53fd4

SHA256
d7ad5901c3bfc7927ee187ba3050db7cdde2bd88b439d5fa07426049285ea981

SHA512
c3ed123c734ca65628eb6a6d6be2b8ef8acfc80fae31de82552f92380729e0419f99b47810d4153ae7514542f1407044eb930c380e4a9c8de4a970d090130a2a

Download Submit