3aceca468c434056554527785c23f6d2734926aa26b7a557e40b42f67cf41a3f

Analysis

max time kernel
119s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4330d60a9ba05a1d5f000807c3c02a0N.exe
Size

42KB
MD5

d4330d60a9ba05a1d5f000807c3c02a0
SHA1

051c1c2418afb1a711d6624f8d9a295b155b02c3
SHA256

3aceca468c434056554527785c23f6d2734926aa26b7a557e40b42f67cf41a3f
SHA512

d7dc1f5a2c8275d4630e4b376d3d192d8aef58fb7b8e7c9bf740775df931e6d7de05fa4628defdc72d1b5444e98e6080a60134c299fda4101210a0a43614d4ae
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FzzwzrYcUYceQ9HsQ9Hr:/7BlpQpARFbhNIrYcUYceQ9HsQ9Hr

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4674) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.X509Certificates.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4330d60a9ba05a1d5f000807c3c02a0N.exe

C:\Users\Admin\AppData\Local\Temp\d4330d60a9ba05a1d5f000807c3c02a0N.exe
"C:\Users\Admin\AppData\Local\Temp\d4330d60a9ba05a1d5f000807c3c02a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
42KB

MD5
4d49d241c5085ed016abd70dbe33b94b

SHA1
012b155a8ad93c7f144723d37bb979c895dcd3c7

SHA256
2dabd8bc17d0e4ec3bbd66abd9ae34102fb32946583a9b1b8c4784fbf1151d85

SHA512
b9aec6dcd907eae3b9ec834cc54a2f3f6a73d32c4bf3640b17986521ff1f946318627bc9dfa385d02d254cc90c54e43134e85b76ece57804bcc87186f5f2e428

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
c8050c633ac171356003462d536d3d84

SHA1
af62450d7e6c71f87f5b53f13188b844cf7fe8bc

SHA256
b739af7de394ce2ddd77bc0b9fce3d9f4296f9b3480718565f1c451b42b7a13a

SHA512
b15ea3123d9ba2d3c8828be53b02c024db86a8b4d07c64c257650eb3d68586a428219069b05117c2dc015a3b020cac55e9a26f0eea6c0769001d9358a87d080b

Download Submit
memory/3424-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3424-1966-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download