d3a137d92cc766d44214b351d4355846121d4f5760cd4cb22f4d27a05c4e1eb8

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

618d1964ce89af7c0a6365f32402cf00N.exe
Size

59KB
MD5

618d1964ce89af7c0a6365f32402cf00
SHA1

e1d4b19391df358fa22568dfc640e65e47f8a9e4
SHA256

d3a137d92cc766d44214b351d4355846121d4f5760cd4cb22f4d27a05c4e1eb8
SHA512

54b73dd54f99d02609320a51c13b9872749f1f7831d36bd312001f446008c294d4efd8b96d4529e86547c45477bebe7e728d0c92dc19316876e03627bfe73d2f
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcF+kioCHo+ioCHodYI:/7ZQpApze+eJfFpsJOfFpsJk+k9j+9jr

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4648) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.dll.sig.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	618d1964ce89af7c0a6365f32402cf00N.exe

C:\Users\Admin\AppData\Local\Temp\618d1964ce89af7c0a6365f32402cf00N.exe
"C:\Users\Admin\AppData\Local\Temp\618d1964ce89af7c0a6365f32402cf00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
60KB

MD5
7b0a3fe1b7aa05784a4b37ce75668578

SHA1
abd114d266af9f97e3e590cd9cd8d53324dc51ee

SHA256
ea8543daa4afd939caaf7faa917d08a08efe5726fbb3a2d13887e87938b2b519

SHA512
50ba11c229436d3e2a27ec6bc3051b83d7ded3073dc9f5d197b2581e5934f77bd64e441b3e25f83296d258f365d6871b94c87499f3b853c4fe6e0b07f5dfb471

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
158KB

MD5
21a579fa5a33b4f2c605ce22f98fcdae

SHA1
9519fc932352434b4c0b69e5f6750a77141a1c41

SHA256
142584500f7d76a6a0c2f6c55224a04751310761b5c4439c8baac39a8f5caff2

SHA512
01105c576710a8280a5604a68afd2083aa656feb6ea8c8770151c3cda94872de0257c205c23c019c7d7964633acb1ce631e453cc5f2530907dd7f093f86a8cb5

Download Submit
memory/3888-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3888-898-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download