1c20cbfd09cfde29d7a28f1f67957be0c1dd37aed1f4f0db014762c6af0422b1

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06d06ad7598dd5168e91c3221623b1f0N.exe
Size

96KB
MD5

06d06ad7598dd5168e91c3221623b1f0
SHA1

669b39092e9ff6099f07e88501ae47018bacb72a
SHA256

1c20cbfd09cfde29d7a28f1f67957be0c1dd37aed1f4f0db014762c6af0422b1
SHA512

66a135af6230e6afdedcd6815ffba69327d48e53781603707db0999bf784d4f0ca4ddc034540f874ba6c9e899ee90df544a82b3f7f3e6653e372122565ec653a
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBe:PqFF2Ie+efsLK

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4623) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	06d06ad7598dd5168e91c3221623b1f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06d06ad7598dd5168e91c3221623b1f0N.exe

C:\Users\Admin\AppData\Local\Temp\06d06ad7598dd5168e91c3221623b1f0N.exe
"C:\Users\Admin\AppData\Local\Temp\06d06ad7598dd5168e91c3221623b1f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
96KB

MD5
1b229d9428f80934ce5b104f76ad6f29

SHA1
d3e6dc8bacdad00115f2dc5691a4e67f2017be39

SHA256
45ef56d57ace9e562b0981089efd253a0c3d6fe1ffc7ebc8d608619fd37cd376

SHA512
4357212c5d8b2c46a97fd8ef33becc61b5676f9ac729e381fe3f7bb9b2eff6f55ac394f997a6b0c00c7a76950535ccd299b9615b05d83ce8ea001274873792a9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
195KB

MD5
c5b098e578a3c384294051001f778c48

SHA1
f36f5b7f2f07510a95f8134c753f620cf03a00b5

SHA256
5ccda5002eeb7c9af3593f207b8fe66f45eaaef1b79e86f723d91e4dd277f14b

SHA512
d96fbeeaf1879cc580948859da0e1685fbe8ff93f6ed1636081828035aea5b24d9649d00a707ca75457bb04665a83eb181230e36d433264e00ff7fe932aba0ec

Download Submit