f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
Size

98KB
MD5

c49acb867280dcd10f61707c24400e56
SHA1

ce0a26038e7232e6e9780ce0f83ec1d1c905530e
SHA256

f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5
SHA512

e4a55ddedfa5239de035101e2e5d28b94fcd34e88bfbc67c6e0e93ab433b490f4ac379f63aea9214e0ca3f67a25508da6c0592f5d0735458a56f2b5043c82424
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyB1:PqFF2Ie+efsLZOC

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4876) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\LimitCompare.vsdm.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\eventlog_provider.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe

C:\Users\Admin\AppData\Local\Temp\f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe
"C:\Users\Admin\AppData\Local\Temp\f16fc4ce75c3ddd7a98b88cb719fa2621c89bd0ea31b5cffb2546c7625313eb5.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
99KB

MD5
669f6f327732ff6ea31e811e0647a595

SHA1
66643380902fdddbdc1282dc0135ab9c501c7898

SHA256
e51df05c5f6ef93cba4bcd98a98ab268c864c6b9e3a5005c04454a424aa7d72a

SHA512
9d5c86d216a14d2226d36c6f1dcca5aaea9690b27cee7bfde7baa92bf8d2e1155df34a35a2f46d950a137d3e4a9221b9bb15debc5d3ecf7ac96556401fa95d7a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
197KB

MD5
ffa0d2392d646b721f6d920af065a42f

SHA1
6739c96230fb65c7036f08c1bf1fbb380f05f033

SHA256
9e2df4fc36f2ce3fad470401810caf1ff603414280346fccd96197a3904bb83a

SHA512
56f13320ccd4801584278d008bcd7eda9035058570e833eb96cd993dfa1aa3b2e6ddc587388adf14c737b46a7589a095e9bb513dae1b06f61cb48ff06cfeb4f2

Download Submit