7f3a19142f7da149bc4f86778b77476b3d5922c45b76ea0cdb40d6c38f303b84

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

409f15e03de4328372235a93c81f2480N.exe
Size

61KB
MD5

409f15e03de4328372235a93c81f2480
SHA1

57b4a3ce858b1fd17ed83168dfcacc90f2743f4b
SHA256

7f3a19142f7da149bc4f86778b77476b3d5922c45b76ea0cdb40d6c38f303b84
SHA512

9d1bc47355ad29a6e6172112dfc67716bfa3f707a5534631e978bc863bd8125e46dc24489702ecf8a98492a78792c37669cde357bc47b23cf99aa7a21705ddfc
SSDEEP

768:/7BlpQpARFbhn54fmiy+3BVr54fmiy+3BV6nE1016Y/jY:/7ZQpApmi6nAY/jY

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4652) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ur.pak.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp	409f15e03de4328372235a93c81f2480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp	409f15e03de4328372235a93c81f2480N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	409f15e03de4328372235a93c81f2480N.exe

C:\Users\Admin\AppData\Local\Temp\409f15e03de4328372235a93c81f2480N.exe
"C:\Users\Admin\AppData\Local\Temp\409f15e03de4328372235a93c81f2480N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
61KB

MD5
93fa3307195070282eb72ae61ca72c90

SHA1
93d3b6ba0a8271782660528c38798fdc86d27584

SHA256
d75d269845629057073fa39691861a440703503e59a87cbe31040566325b79be

SHA512
e975d166046c757c8be9e0b2e032379f81ac3f5697d90261784d8547782309a6955a006bd7d9c7ae61cc8ee53d02df03d47a2db5ca1a6a1b20a3ddb2e1722548

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
160KB

MD5
d7dbde3089f0bb0fc33c06440780a142

SHA1
a4e021fd6ca8a1406f86f033c9ee48cfd0805bc4

SHA256
7d088459d70dbcc897935193ee4a2575c3ac24d59bc6dedc8f0ce935813dcc55

SHA512
419b8105f2ecc0ef394746167c25015db73af957259da0e237077e757cc02f1c4f723174c5fea60c8cb531848765852d11a24330d5bcdd309de2d41261b3bf35

Download Submit
memory/1292-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1292-1972-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download