3c2338bf7cc73670e62428a3cb3de3ad72d298d52b7e374d29b96654c881997a

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c6c61ccfe260f702d65b661c24a0f70N.exe
Size

70KB
MD5

2c6c61ccfe260f702d65b661c24a0f70
SHA1

ec0edfe4fffea59e2488865ff836bf29b46946b2
SHA256

3c2338bf7cc73670e62428a3cb3de3ad72d298d52b7e374d29b96654c881997a
SHA512

df8424c80135cdcd981633d16b5139c402d1e022362c2ca5f6b2bae5c15d283ccd0a7fd7f5d3a001450365d25cf37a11f72948f9c1c34f8ac4493fc1682ca3f3
SSDEEP

1536:W7ZppApBULcfpHLcfpX2/Nw/NwmxR2RWTWM:6pWpBwchcV2Wx5

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4634) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\msipc.dll.mui.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ro.pak.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsFormsIntegration.resources.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c6c61ccfe260f702d65b661c24a0f70N.exe

C:\Users\Admin\AppData\Local\Temp\2c6c61ccfe260f702d65b661c24a0f70N.exe
"C:\Users\Admin\AppData\Local\Temp\2c6c61ccfe260f702d65b661c24a0f70N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
70KB

MD5
7604db2a4840bdbd881f360125486a7c

SHA1
9c3976376ab3e92497e605be55cc17605c122d20

SHA256
a329d2e34daeb684d2f45d1deae0e5f6494c67c2a1fa50aabdc41e36ab9b3c9f

SHA512
7e24bb9daf1f4ae81ecbacaed48c05f9f16cd5bc7724675341a3c71552ee08cf81fa237cfa298417a66995f5125965cec72f23a942371bb8dd85b2ddef1d452f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
169KB

MD5
64b2741dd11143e5f2086fc1205b6618

SHA1
4f827cf27b14f50342e4c1e9697a5043268260bf

SHA256
8e18ffe38ebecb360a5d165834237c0fec19f62448fa5aa19167a8c39e67f916

SHA512
53962ca4544b98f45302edd530782cfe0ec7e3b2ca4045ff1395ccbd4d72a75e262280cf61e41bad5776aa5312b6aceff48ef91e165857b5fca843171d80f93d

Download Submit