4b488ffae46ceff32cd4d9af82f52667e04ba2e6f601637fe0622ed183ed4eb4

Analysis

max time kernel
119s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

200a4e9f73e5a0494f42244feb1de580N.exe
Size

44KB
MD5

200a4e9f73e5a0494f42244feb1de580
SHA1

8863d4e97f24f6198b75a3ee546e54be385ce06a
SHA256

4b488ffae46ceff32cd4d9af82f52667e04ba2e6f601637fe0622ed183ed4eb4
SHA512

7c7956dec9039c47368ede2bfb8d5146cc37015263019c433744f76a775cc989ce55d1e9f366d136490aad0a19dda8e6e60f91d1eb35cf670cff25ef3493f2f7
SSDEEP

768:W7Blp+pARFbhBgnKLMWK9WKD2N2P7ZM7Zp:W7Z+pAp2nKLRKIKqoP7ZM7Zp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4679) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hu.pak.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationTypes.resources.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jre-1.8\bin\management.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\kn.pak.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sw.pak.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\CompareWait.m4a.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	200a4e9f73e5a0494f42244feb1de580N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	200a4e9f73e5a0494f42244feb1de580N.exe

C:\Users\Admin\AppData\Local\Temp\200a4e9f73e5a0494f42244feb1de580N.exe
"C:\Users\Admin\AppData\Local\Temp\200a4e9f73e5a0494f42244feb1de580N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
45KB

MD5
3180ce18f3e963be1b49b8f604f037da

SHA1
cd2f0d602d42fc2bb2724ab5fbd300bb5e1a9f8c

SHA256
13572789af3fe71f2d86b8f71b7104b3c29bba7332692baa241c307ae46a84c2

SHA512
b137207a76bea3bfc4ec8d1f607bd5383886ffeac17ec270d1a89756100ec544416ae16bbf95705156f1be175e68ef6424b70ef2527c2dcdc65bd8751582d5ed

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
6257ed563a81dc03849e6e3f6a5af0a9

SHA1
366ade1768f5010c26f1c96f871308d778ff86ba

SHA256
852bdd4ef2311ed6e7b50432e075c7888d8e85a7ac8517f26eabc52a315e7966

SHA512
0146443bf3c9f61baef02e97a39ed4aefac6212ee0ed3da2a1612566a29ad5a829215f5780a0432256417c34dcef4d11b2afe0500efcaca791a8c17996e93d29

Download Submit