18864111f3ea01a54f65c7582abbc697971fe67c22fb374261863f03a4ab8257

Analysis

max time kernel
120s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40f596c99b825109c55ba858e7f59f80N.exe
Size

56KB
MD5

40f596c99b825109c55ba858e7f59f80
SHA1

c74a2f00837c5c13f1f59605b49e763af3811245
SHA256

18864111f3ea01a54f65c7582abbc697971fe67c22fb374261863f03a4ab8257
SHA512

501f483a691a2c0dd61027c44375964085c760e589a09cf912afa547e18f4daad23720db64ab2471d220d675944ac306744eaded6a71534191873864fe7e6a6c
SSDEEP

768:/7BlpQpARFbhq1KWYLJQBJQ4xyxbmi1xjxbmi1xg:/7ZQpApq1zYLJQBJQ4xyPHPc

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4601) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.tmp	40f596c99b825109c55ba858e7f59f80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp	40f596c99b825109c55ba858e7f59f80N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40f596c99b825109c55ba858e7f59f80N.exe

C:\Users\Admin\AppData\Local\Temp\40f596c99b825109c55ba858e7f59f80N.exe
"C:\Users\Admin\AppData\Local\Temp\40f596c99b825109c55ba858e7f59f80N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
57KB

MD5
6e9b71b37c026d5e07512cc79258bbb9

SHA1
dc23dbca7037f508ecd9b4dff2d1a49881a5deae

SHA256
4297006b4de46891ec16a73a63e50565701e44a1de96375e6fd8d92c001b91fa

SHA512
a7a9bffc19c1bad860ab65107e71413dca98b4be4c3de0ccb7e38d33e85a134df49c0b60a0e29b116cb9e7ab105179cbf437821f859aed48cf5b1f80d7135b7d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
8215fe2ae09b4f57f47a3bde508d4502

SHA1
ad1bcaaba4d42c617a30fbc92dbc78c7263fa468

SHA256
2c8426b43b51fa3908d7c993d3d42326c88fbc0500b9b7bdbf56c9ae147b09af

SHA512
c904a37b60c74708f18678d4da89c911b702104d345e22d57bdadc717eca660ea34eebe951a61d968f60595d4c9462762b732acaf063799be96ebb7e5d47c200

Download Submit
memory/1396-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1396-850-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download