4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 22:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
Size

45KB
MD5

c250b2b5bd8e19ac98c8298fad4849b6
SHA1

bdd3856aecf99d33f11b3be42d4e30f901c6ce8d
SHA256

4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e
SHA512

52b6ca1b010814ae81c9d13b73d9f10039c17fea6145eaea38779610a48c7db2b3817824709c476852241f4bde3b5332663152799034cb520daacb50f79a9d01
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLmuH9uHBlNo:W7ZppApBULcfpHLcfpyD9uH9uHvNo

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.tree.dat.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNI.TTF.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe

C:\Users\Admin\AppData\Local\Temp\4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe
"C:\Users\Admin\AppData\Local\Temp\4f6c1c459264c0d0a1b8096ed78fd41fa3b4f144543134b0d99b77290703434e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
45KB

MD5
1623bcacd20b7e693300001d3ee58270

SHA1
d0fbc97727a65728052ff55eacb8768607101430

SHA256
317210d93690b50c2d150a5132fb652f44e08742787c3eb8cadc82e4b9261f29

SHA512
28408ef2daf2b9ab18be88c37bac70f8f83d3b0e877424736c1348e60f8cf4fa2a0743e63d3f5291ebd4a6922258ccc4590aee4417dbffbb16761eb3bd4cf954

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
ca2cd77d47930d7bd0ca9805382cf66e

SHA1
c7ac5baa3c169b32bc9d94090964937c0cf55dec

SHA256
bb23e86bdf40b3665a0b6d6ff0540157da6531de1c682fac11e3a3cc4bfeb3d1

SHA512
7301d14641ca0cf6b572c64b19d29161ea0a9f4c37449060711b7e7b563d2e63ac9a08d62e9e325432b2a86ca3ddb63412d3f92023157de36de74e93b2e6ab19

Download Submit