593af8d985bc72320cf5fcef5c1007c25c42537073eef79b90bb41f4c9726e73

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f61b54897e6dc2bd016be69e1fc24510N.exe
Size

51KB
MD5

f61b54897e6dc2bd016be69e1fc24510
SHA1

791067261714d0d576f1a078812a57826d6dd182
SHA256

593af8d985bc72320cf5fcef5c1007c25c42537073eef79b90bb41f4c9726e73
SHA512

28b3475ce78834751266cd36b2c8ccbb8b6b0e8eff464baa7adcc4e937d781d2294812dfa8c039b92ebb08d31f967b0afe2cb0ba087eb70ca34018c7c23985c5
SSDEEP

768:/7BlpQpARFbhn54fmiy+3BVr54fmiy+3BV6njYw05jYw05Kq:/7ZQpApmi6n8wBws

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4683) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\mr.pak.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\tr.pak.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f61b54897e6dc2bd016be69e1fc24510N.exe

C:\Users\Admin\AppData\Local\Temp\f61b54897e6dc2bd016be69e1fc24510N.exe
"C:\Users\Admin\AppData\Local\Temp\f61b54897e6dc2bd016be69e1fc24510N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
52KB

MD5
fd8daaf314524779b3f89a5a6ceab427

SHA1
b49f7c31cc22a529a0bd74deb84b1071a79af430

SHA256
a4d112efe681ee4cc8e1bb9cde29456a12b6e74495b73f1e917701df464b2153

SHA512
b095a9349eed9a3a4da7695653f59a2bc85cfb6f715072c381cf6af79acf01768be54acd7692bcec30a0c7a7b93939d22d44cc285362cbeab65173e96af24ef1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
b1180355091a0d2a5bbb41a694441965

SHA1
c5f81270a9d4b07fb0b617036aa258a4372e2988

SHA256
0c91fb6ddf726f359632799c23fb053ac46878a010abb4f122368dba79b012fe

SHA512
d017a1403a6b4a305129aa28615c9525e8e271d2aa2f0c0de1cb6a10d7b10fed7e303dd38754222f6e68de3437f1665d5eee68a65d515229baedfa4c924529b7

Download Submit
memory/3680-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3680-1004-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download