a936c10fd2cf9885845e99ba946054652704db41b5e3be757bcf03e47a13c66b

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c601e928832633520ff2a01326f568b0N.exe
Size

89KB
MD5

c601e928832633520ff2a01326f568b0
SHA1

34a55bff77ad99b0bc1bed0c83fbb805b909d693
SHA256

a936c10fd2cf9885845e99ba946054652704db41b5e3be757bcf03e47a13c66b
SHA512

ec54bcd3a98bb2a9b2833bcb3bee48724a6c6a2ecdbce9589ede6413e6a26f1a9ba5ccce38bb85c71bc44bb1e594b7d4808aefe4d5648652498c6a2c917db91e
SSDEEP

1536:W7ZhA7pApH9QHwtRF9ESWu0SWujodsodaNovTW+SPL+cycWAF689i4:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9r

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4613) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fr.pak.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fa.pak.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp	c601e928832633520ff2a01326f568b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c601e928832633520ff2a01326f568b0N.exe

C:\Users\Admin\AppData\Local\Temp\c601e928832633520ff2a01326f568b0N.exe
"C:\Users\Admin\AppData\Local\Temp\c601e928832633520ff2a01326f568b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
89KB

MD5
498367d8a9cd8b3cdeb25ec91d73cbee

SHA1
9962e24f76a351ffeaa47df9559bc96fccee0f54

SHA256
df514278b3e087d360980536884237fc760dcc8b68515b1fc2bccde09c670e45

SHA512
4a7fa1025e5be2945461f2772bf097575047ac5f2731d6a072b9a56f395ad5aa2ad31eda4f15e9c47e8e7cbbe81419c2e0dec1f25a13c2419db74c42e542aa2b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
188KB

MD5
9d144b43efba698f574501ea139a1712

SHA1
c4b2e7db5faecf5760f26feda8d868beea493df2

SHA256
d284a4dabcefcc38a900de3e64f9e1290f27b3cf4ef472a065a22c48569ff671

SHA512
33019c431870293e0b0a083cb175d620999b4f426f1c62f187150b9ff94373b8c1fde9ffad269ead8ed2e06fea282d7ddd7b9350b5ad401629efefbff7880cad

Download Submit