73a93df08bcee446a1774a1416cedd94b9cf0840b6a89dfcad9bcf86373db32a

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

716e4eb6c8f26e8daab50daded930440N.exe
Size

1.1MB
MD5

716e4eb6c8f26e8daab50daded930440
SHA1

9131849371f9b2f87477f7dbf1f83bab9bdadbc1
SHA256

73a93df08bcee446a1774a1416cedd94b9cf0840b6a89dfcad9bcf86373db32a
SHA512

4409a1bec01a6c0c8ec091b52eef7dff9da6b813b577b7456d282994767d9a14fb2a890891e753e17de04c96d40ff4460d87f448477114670105b85e003f4bfa
SSDEEP

24576:xKCNJhOvQFoPFuEpu6NfEl1hM5IUtG5Yekc3g5:xJWQFoNuEpFN8ttV3g5

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1756) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Crashpad\settings.dat.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	716e4eb6c8f26e8daab50daded930440N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	716e4eb6c8f26e8daab50daded930440N.exe

C:\Users\Admin\AppData\Local\Temp\716e4eb6c8f26e8daab50daded930440N.exe
"C:\Users\Admin\AppData\Local\Temp\716e4eb6c8f26e8daab50daded930440N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
1.1MB

MD5
3b0311e93d23a8739c997f9bb1a8484a

SHA1
da910bc6ecad384c0685cd2ebc89df6403d508fe

SHA256
d1f56e8f884abb97589ff9d346a80649e2959a98101588658003ad7642628b36

SHA512
c59634a88124d9ef25043383dc1fec1e20c462b1bf35e0beef73a76c816973405039f7bf2427fd9263c91070e13f547f8a148e21ff9426ba1effe54cfd5d9a6c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
1.2MB

MD5
a2ed27444457c26c2bae98cde902e0c0

SHA1
7f5679374c0517084023d9f9bbba9cff401e0611

SHA256
da90b74441560c6c82a3141742d33b2f8dca52f14277d769af445221681a5a4d

SHA512
2587f27449f8e25b0b115baba3248e906e0adee12a9dc7bbddba7d2562197867f688806a6cae85e710733aa5559ec3fc49d3df2805b4f3cf282469a1c3d7a9b8

Download Submit