dfd36781127be75ebc48fa9251fb9278004a792e3fab2747a1be01dc9a1f3c1d

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

254d749a1c654f204830fce14f7cfe20N.exe
Size

98KB
MD5

254d749a1c654f204830fce14f7cfe20
SHA1

71a05776100aa35e44650e110865a37dc4f051af
SHA256

dfd36781127be75ebc48fa9251fb9278004a792e3fab2747a1be01dc9a1f3c1d
SHA512

67a51bddd987bc91e05bcb16c619782610cf91fe085e6abb57b32f61023b3db0e8ca95f7196b99129055678448b492a9993e16c5eb4b1e242fff77ec98b7cf81
SSDEEP

1536:/7ZQpApg9u9rYmdC4cq5AMaBikyJ+s6LiU3H:9QWpyu+JDIkyJXU3H

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4622) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	254d749a1c654f204830fce14f7cfe20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp	254d749a1c654f204830fce14f7cfe20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	254d749a1c654f204830fce14f7cfe20N.exe

C:\Users\Admin\AppData\Local\Temp\254d749a1c654f204830fce14f7cfe20N.exe
"C:\Users\Admin\AppData\Local\Temp\254d749a1c654f204830fce14f7cfe20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
99KB

MD5
5cc8456731edcf815c2936c6bf2991b2

SHA1
9b6a35c16b6767cae99c9e92e68d4997c1d39e32

SHA256
dca64d10d09df1e14309e63eda2ad4855d94879c28b1380f7e063d437b0647e8

SHA512
2a1401b56c419b80b1648e0c3364dbc0289f9fcf44464bc1006729247d0f16eaad3cc53caf19a23e4ac36e4d035e9f48469c06a9b99132e3395e7db1b0f73202

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
198KB

MD5
bb72871af60d038b2ede5701b049d98e

SHA1
7f16944014aa9081ec07c655f27237ab79b35aba

SHA256
c41e6727ea3e344400fdd106612a1e50245466755e4415b6050b87dc68966565

SHA512
7f24e073bba2e7b65b758066a5c80d4eac0ee914c0be1ca5f3c7c1d69e3ad742c65792dca56ecddfde56673e5dd7ddc584dd040bf29edf2abb9950f363683626

Download Submit
memory/4792-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4792-852-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download