0e5f31d7a352737e8bf766043555ffb4b994cfa9964db302299cad7a487d79c0

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5690691bbf0f7b2c1b61e84948b0660N.exe
Size

44KB
MD5

d5690691bbf0f7b2c1b61e84948b0660
SHA1

2ec0daf62c4cea8e4817c3b34c3c3704e37d5d1d
SHA256

0e5f31d7a352737e8bf766043555ffb4b994cfa9964db302299cad7a487d79c0
SHA512

ee09393b17a33f73ed46c75c0e5ccdae579b01bc6b480e0691ed211d95fdbe6c3b62ed3b806c8b9a3270c8842b0718270f8080cdf6054ca95adadc26551d0958
SSDEEP

768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJWX0kXX0k8QQ4NQ4r:W7ZppApkGpJQQ4NQ4r

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4668) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Crashpad\metadata.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp	d5690691bbf0f7b2c1b61e84948b0660N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5690691bbf0f7b2c1b61e84948b0660N.exe

C:\Users\Admin\AppData\Local\Temp\d5690691bbf0f7b2c1b61e84948b0660N.exe
"C:\Users\Admin\AppData\Local\Temp\d5690691bbf0f7b2c1b61e84948b0660N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
44KB

MD5
12fa246b7136216af0ec86ba14131ee7

SHA1
4affee3be68223e0f157444d1767801bf59deadf

SHA256
017da87e5fe329081733f3f6cf94884b101cf833c17d518eae13d53225df7d9e

SHA512
27fe86cc7d791bf56899a7fa3b1baddc435dc7f1049d98ecafaef8ab1ab19ac87f36103cf8fecbc957b5476a71b4c4bba9caefe6f92dd08e51d84053c4cda71f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
143KB

MD5
e496323c03035785a12a50150244ea09

SHA1
e2c90d199415b369f633d4796bb54b63e54f8bfe

SHA256
5ba1923820e867a989136e807ca34b518fa580fecf11732efd159f6ebd05693d

SHA512
ece7254b5e5fb313a6ef2a1511931e95ddf1b191abaecd977a3eeafa8172fb4fdc5b0db958c94e42beb4a8df8879ed02c99beaec76a5814b68b5aa37be6dfc03

Download Submit