b9fbbc9619697dbbe86d020585209e1d848d9439523ae48bae91655c1d9e3396

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfb2a37bd75bda8f84352365e6806c90N.exe
Size

201KB
MD5

dfb2a37bd75bda8f84352365e6806c90
SHA1

fe60a934c05556f9b6549666b0f2aedd0c091ce9
SHA256

b9fbbc9619697dbbe86d020585209e1d848d9439523ae48bae91655c1d9e3396
SHA512

f59049fa3910dc2df4b0224019bb30573b9bd944250cea02fd835cc4a95ba8d400a433fd14e9314da2cddb29ee387e9bc272189c6c36bf62ef17f7886131ffa5
SSDEEP

3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBJTzki:RqKB+tOkWKR0iJ0lTzki

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4027) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	dfb2a37bd75bda8f84352365e6806c90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfb2a37bd75bda8f84352365e6806c90N.exe

C:\Users\Admin\AppData\Local\Temp\dfb2a37bd75bda8f84352365e6806c90N.exe
"C:\Users\Admin\AppData\Local\Temp\dfb2a37bd75bda8f84352365e6806c90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4056,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
201KB

MD5
558ff816e2de84cd58f0a37e56a30755

SHA1
1c89b33e07be1522fcc56b102788a0be6016f59c

SHA256
759d97c9cced909a88cca679f8734763663af8179f64ab8cdee4449c0f3aaca3

SHA512
7fff40c3413bca0da6d8e083390d006f9038575e84c77d5ac1ab80c05f1aa2643b4cccb1a6574c6e2e1cc52f8cea022c0a6b01734c398ceaccff1eb713c09210

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
314KB

MD5
d42afb602e40efd5311a627beb5ebfad

SHA1
8d8c1a0ef936f37a360949030c913e5f8195f91c

SHA256
767b3b3c57ae808a7b98468ef67367a684b0b0266483a008822fbe20e1d8ef80

SHA512
1fa040abb239d5506e396f90bcf877ac1da4c36dbb9d6fca6637d5ff0b4e355d53aaa91b9071b0bb977164d63556e202f512ebc2790421a1fc53b43d6573e434

Download Submit