42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
Size

75KB
MD5

60f174fe7b71f540de956c13d13b9c9c
SHA1

6eb1e04ca88ea5707b2aa3d272e831deeb021645
SHA256

42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9
SHA512

38e8c6bb89ed6e1c813d188a5d6dd155c56f5d3a2e2acbe73cf313261c50b7e5f6cdd047663e89ca2936958ce9f8e0a35981fa1974ed5bff2df43459c7cc5fe7
SSDEEP

768:W7BlphA7pARFbhvOsTKnKqtb4HBZjlwGpCYnigugqOzM9bdifwMtxEwJjlVki/m4:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordcnvpxy.cnv.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.DLL.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe

C:\Users\Admin\AppData\Local\Temp\42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe
"C:\Users\Admin\AppData\Local\Temp\42fac393c809e3640025fc5d0af32eb70a96d347b892a191c95e1730d82f11f9.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
76KB

MD5
ede64e0040f7b2c98dc443543e694365

SHA1
2dba294461c7554202ac821a922ad75db7f05dfa

SHA256
322acfe1d32c2215f3e8376f2d4e7071705dabad78681bd2173e5a89653ae669

SHA512
74552dd567a859805adc96356229a85cb4ad978e72032b1b8ee222ed16df82bc5ecb372e460de6b62a4aa2c73a894cb79cc2d71358017518bc0211ac540c7363

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
174KB

MD5
1135dcf014f8f5b75399387f67681a54

SHA1
d57f7699bafccd84406e02fa3d0d0ff1fd38d60d

SHA256
349242feeb32c5c1d9b88bf2115539cefb69ed250dcfa617a6469d64b550a6b6

SHA512
9d2619e9cf80e4d379d2b0a2034bfb3d9f025fb6fa3ddc100e8bd6e0c57aa670a02f906436d57c8c8db85052adb3c4454e48d79baf9090b0cccbec6be0e54dad

Download Submit