f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
Size

52KB
MD5

999ee3b33f444cfd3eb245a6e122a350
SHA1

16ed4bbe3c3e33e2f7ce98bc439459de9f865fae
SHA256

f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b
SHA512

5d4eac5e56f56509629cc830c33d6b79d114d915e59be9b72708c78673b7dc07fcf9c298c967e16cc0367ccee919422009d3f0df336ba50e1a94f7033561dbc7
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJwRJofJoToYvJtLJttH:W7ZppApaJofJo8YvJtLJtN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL044.XML.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyLetter.dotx.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSI.TTF.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNI.TTF.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vulkan-1.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe

C:\Users\Admin\AppData\Local\Temp\f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe
"C:\Users\Admin\AppData\Local\Temp\f6cfd2ae5c9f0fe10784a9fb44c132231ea10f0f32dcd2335abe412d3712d23b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
52KB

MD5
42ce942dcdb4078988047003147d6d86

SHA1
97c139e334367b45c2a91004c9b580b29ab88846

SHA256
135bf2757f50578884da7c6f884850ee81934419884dee3d316f1863225e8b3b

SHA512
f2d19903160a57813d503421154e0d865cdc599bdf7ef3f8818ba5a5331b506891a0eff793b361f97fdc4a51a92efebd9b0581c569b22cc4d4538215456f1567

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
7dc6103fbd3892455a000a4528fafb0d

SHA1
69cee72ee5bcba8237e7742b56248da3ee195c68

SHA256
3d841f0d8ed13f112a13f39a30573b9fbbd7ecda41785fcc6bf47dd37b1f9ffb

SHA512
498798a4479785aef663f6aa1dc29cd800056e7c40c4147a3c522c5967e030cce43cdbb3992aef84af8d285a0ed91a910aefde7254dfb970f0c66da94b6cf36e

Download Submit