1e007ec36b08a0a34e616b0c58c0092f48e5a2ece03408d0e6f0074de10af3bf

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f68a1efe8c6baeaf05cb004c691b900N.exe
Size

77KB
MD5

9f68a1efe8c6baeaf05cb004c691b900
SHA1

b638ae2779f2edef7dbf7ac3e676f9b36f30ef1b
SHA256

1e007ec36b08a0a34e616b0c58c0092f48e5a2ece03408d0e6f0074de10af3bf
SHA512

0d5bd917bd04c1c744fbdedf83970605e50acc9299397eafd3fe0120c24ebc46704b9ce406779736f28dc7a566f052cc242feab3de035b51de9db3584d8d3e98
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZvapBpYY9:6NLWpCZIzjwHw0

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4648) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClient.resources.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\da.pak.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Java\jdk-1.8\LICENSE.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sl.pak.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\BlockInvoke.inf.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	9f68a1efe8c6baeaf05cb004c691b900N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f68a1efe8c6baeaf05cb004c691b900N.exe

C:\Users\Admin\AppData\Local\Temp\9f68a1efe8c6baeaf05cb004c691b900N.exe
"C:\Users\Admin\AppData\Local\Temp\9f68a1efe8c6baeaf05cb004c691b900N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
77KB

MD5
7e0798eba946fed9ff30b57f09359601

SHA1
2eea5d4d102c8977e8768d7b72b908f40b8e91b5

SHA256
5c4849b3e0a9b4a85770e9bd12d2a43b2cf13b2df0ea4d10bfb3c30fb4b8b990

SHA512
1b470cd39642bd60bafc7401161870287fc5e3bd7ab685db107ad3029e6f4e7027c02f6c3878825f01c33f915dafcde7bff235411c551d57cf24431e87eb5450

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
176KB

MD5
aa0ef5d99d9d22c18e6a3547c6f6c2c3

SHA1
bbdc68a6048ab620ad3c97677a0853004365ac13

SHA256
cb192eef96d73106911113e45cafb31d9087ed60f4c6d6136889235214f8d6ca

SHA512
9c9facc7350b405e4d8c2bd189f20b28c8f1e311c171006ed0a8c72ead9ba4efb5cf811eb8d6deb2167eae98edbebfe936015e8019900db71fc91798d25f99a1

Download Submit