ac8d608b0c9663f021672f531ca249e3f1e8f963d43046ff39402a910dda896b

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

932aabf9d9ede6458b98b07aafaeca00N.exe
Size

348KB
MD5

932aabf9d9ede6458b98b07aafaeca00
SHA1

3423a72c5e15c89168e580f0d801bcb10f50f9fa
SHA256

ac8d608b0c9663f021672f531ca249e3f1e8f963d43046ff39402a910dda896b
SHA512

75c5d190cd95b24acc43fb5c9828387ce24de075a676bce5ffe946af40bf4dc88a031851b5ccd7f87851cd74d31ed285da3e966d3f29d33e94a987b6dad98ee1
SSDEEP

6144:Ldw3IOnhrE8GIpeozM2ZwX8aCVECYsAABvR2oq8SZ3DmK:hw4OnhrbPpeZDCVECdlgoq8SZT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3205) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\el.pak.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\HideClear.vdw.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	932aabf9d9ede6458b98b07aafaeca00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	932aabf9d9ede6458b98b07aafaeca00N.exe

C:\Users\Admin\AppData\Local\Temp\932aabf9d9ede6458b98b07aafaeca00N.exe
"C:\Users\Admin\AppData\Local\Temp\932aabf9d9ede6458b98b07aafaeca00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
349KB

MD5
47f4a6d20874ac8429620837f813623c

SHA1
a9820b32eadbc38513aceacb100ab7ca24ee4c6f

SHA256
e11db546f9494b8415b4da7270bcee0606e62ca0d871fc0b116fe4321979fc5e

SHA512
9da162cf599fd210e363184e096563857e63515a8b84c6c6518e390c7e0981af2a9c53b002c593c4b8354258f3304fb8cf4bedc6f4927f973a21ababb2dfa0b2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
447KB

MD5
82013be664d143561c0e904a81052c2d

SHA1
f70e6aacf7bea5f6ebdd317150c588cb365d0c1a

SHA256
0f9672da1aba03b0df87811e04677750ffa80a9f33f579223990866c7526155f

SHA512
6287c12015ce77d09223273316c7e1b857dca208b33d568817326a3440e2653c9510f9fabce699e91f68bbbc1b4f1e1a2e58f0db4ea7d4ab9adbfb9aafe0fadb

Download Submit
memory/2144-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2144-632-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download