4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
Size

44KB
MD5

6c5b6359d4c4955836783ebc2f11467b
SHA1

bf83d2df53d2790699701d52a9ac229d1babdbaa
SHA256

4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9
SHA512

e888499c89a059a5a7dbda50f6fe2faa86fbacdc3452b205797f649e87a24be015b8e0ee4b30ce46965f999dcc583831d3135c083d069000726dd56e15cc9529
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNF2B5dB5m:W7ZppApBULcfpHLcfpyD2jdjm

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\TellMeRuntime.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.LEX.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\PersonalMonthlyBudget.xltx.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\upe.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe

C:\Users\Admin\AppData\Local\Temp\4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe
"C:\Users\Admin\AppData\Local\Temp\4943cfe4ad8c088c9d5ab0f85804b343564446b7264a6a4b599468f7c02a81f9.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
44KB

MD5
8b1553784327f9ebf50e98bf6b406c10

SHA1
f0880dcd0035d3f6a04f74b77d7265c1862a82a4

SHA256
e9b673d5f6221a1c4e576a179f8448cae7a67de2ec2cc2800a27a4eb24bc76f5

SHA512
bb38c540d2c0876caff45a7d47c04042411af85bf78dd0a4975e51691c75b824256d1804ecb991053ea83e08ce04ab96ccaf36b3466d8e885cb9b4c97f95a702

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
5397f704f33a555e4e386525bc34ecbd

SHA1
7977a748f04214021e0f578cd5b1c1790f811953

SHA256
223181efa5f93d7c4dbddb62beaaf5469af52c88157d7aa75b843a9f582a3e68

SHA512
b6bde59caa6a9e637dccb45691e24ca51164d0e3d218eaa46547fd8b9ad5bbd12d52176e2c4d2070d8f3fdfb0540d2af0421f461bb7ef507dd9842e4cd8ef36e

Download Submit