d40449c9aafd9705992129a7489daef314f8f22e88b3536c699d8130832bd8be

Analysis

max time kernel
120s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9998712877b7d12ac466d25854ae4300N.exe
Size

59KB
MD5

9998712877b7d12ac466d25854ae4300
SHA1

da7cdcf00b32fff0c0a7e154bd3050ac10b6da30
SHA256

d40449c9aafd9705992129a7489daef314f8f22e88b3536c699d8130832bd8be
SHA512

b7c393f38fc6020e5d5780c667cecedcab1d1dc279f057e42a5d289c92ed9b0f12f6b4a1c5b2894e90267d797098fe58576469b7d30e9ae72a8d1ebc5aa957fd
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/EZNaLmu:W7ZppApBULcfpHLcfpX2/Nw/NwmxLTK

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4652) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp	9998712877b7d12ac466d25854ae4300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp	9998712877b7d12ac466d25854ae4300N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9998712877b7d12ac466d25854ae4300N.exe

C:\Users\Admin\AppData\Local\Temp\9998712877b7d12ac466d25854ae4300N.exe
"C:\Users\Admin\AppData\Local\Temp\9998712877b7d12ac466d25854ae4300N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
59KB

MD5
4da7f2d3132aca42c4f3ab6cf71f0428

SHA1
ed5d42f1ab71a8b73d35d79a8071e566f24d2f68

SHA256
b6b445c46adeaac30d1c3e6390aac7d8010b4dd3f049c0fa51044ce69554ad28

SHA512
7ab75768533c1d1cd83c05d68ec6b08ee817b23293d85aec5d37304e750e5d4bda5700552bc02f8653c51bdec6f8e7e133fe771076511cdfc61c844eeb10b633

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
158KB

MD5
c39acef4d5b034e345e65c7f934dad9b

SHA1
13487460586b1ec277ecb6daa4f5feef6b9007db

SHA256
98023b6f08620215247d49c0e5abe917ecd4c5a410b1ed9fd3023d61b48f46f3

SHA512
b8010f663b24d8201f1f2f48f6e691aa2daaf74697983c07b8b41b17ad555ba601cb4a1a247472158566636a50bf33d272293d8aa6e6194831c2035fcd487759

Download Submit