b4cf4bc36187f86c32b4fc6b3314af1172fe878120b6ecbed55963e9bea4f9d6

Analysis

max time kernel
119s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fa6d40f1e269d37d662fb6fdc7fed40N.exe
Size

80KB
MD5

8fa6d40f1e269d37d662fb6fdc7fed40
SHA1

499cfb2410504e3948387ca725053aeef5086cf9
SHA256

b4cf4bc36187f86c32b4fc6b3314af1172fe878120b6ecbed55963e9bea4f9d6
SHA512

51357c4acb818b78672225592c1d076bad8f29d26d9fc5537a7ce5560ce283486d1fcd8b48759991a4e01fe5ece6063ff4555b504d73ff373e5768b8ab942188
SSDEEP

1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlmeU:6e7WpRaSljq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4639) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql70.xsl.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fr.pak.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	8fa6d40f1e269d37d662fb6fdc7fed40N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8fa6d40f1e269d37d662fb6fdc7fed40N.exe

C:\Users\Admin\AppData\Local\Temp\8fa6d40f1e269d37d662fb6fdc7fed40N.exe
"C:\Users\Admin\AppData\Local\Temp\8fa6d40f1e269d37d662fb6fdc7fed40N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
80KB

MD5
24ae61b68c73270524d4496cf64f6586

SHA1
029bba3357e39fd86238c8856f42ef5f3c276536

SHA256
2780c47fb5046bc9dbf1f26d1bb2152fcf2422239103f1f3ae913882fb531c17

SHA512
d30d8e9b62101c3a98a135a711c7d4ef8a9e046cfe2e404f58f310cec80c3a9d97c714e02499874927fe1486c4f833ccdd46eb311b9edab0b259e196448e7688

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
bebdd231137ac375ae96abd860e9e164

SHA1
2eff83d24c5fb54b2710d1ec9ebc60b716a730cd

SHA256
0c0bcf558a8f45ac96b6e2784f1f97becb54425f0d9bab70f3d93d1da17b6675

SHA512
a3d50653fc926a22cc2e625a0a32ed94f5b8b22b4f68565fd9efa1a960f29099883dfc3907645234f16be4a6adad25ce014c600257b88f81f02e0dd343f8a9f9

Download Submit