0118607a9c31346478c04231a6833f171a889d6ad99af04cd1fea566d4154528

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1442c3a48d8eef1aeea62c9a7dddf50N.exe
Size

84KB
MD5

c1442c3a48d8eef1aeea62c9a7dddf50
SHA1

a4d86d71fcdc0db439134fb6195183a1ddf0dddd
SHA256

0118607a9c31346478c04231a6833f171a889d6ad99af04cd1fea566d4154528
SHA512

e5205b317d70e16583203585fc01430869304a19b1d5164303fa44d04a491d98dbf41c682a651e0d888d10d65fdf08417f2984acdd6cf436f6005328bd8e6a3c
SSDEEP

1536:W7ZDpApYbWjIoPyPoLzV7c6ShZQ4PN54PNrR8d:6DWp4W6

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4359) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\external_extensions.json.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	c1442c3a48d8eef1aeea62c9a7dddf50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1442c3a48d8eef1aeea62c9a7dddf50N.exe

C:\Users\Admin\AppData\Local\Temp\c1442c3a48d8eef1aeea62c9a7dddf50N.exe
"C:\Users\Admin\AppData\Local\Temp\c1442c3a48d8eef1aeea62c9a7dddf50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4292,i,1729213506309163284,12809566808978835441,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
1⤵
PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
84KB

MD5
cf1c65829ec1534b94d44580da38dd4d

SHA1
19d67d2c50e4416bd110ed351aa09dce23eb37b9

SHA256
20438236c5e65145229072b0fbef48954d6ea34730e93c89ad134abc2fbd0b54

SHA512
2bdf2f96c1a5141403f3c5d0ea922272449264dfbdf9c4d47562bb69c6ab463e9e610d44302363fcad3269e270979fd78ba27f24b5117959cdf36a4e795cb5e1

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
196KB

MD5
f6b46bb2305275d3c654396807291646

SHA1
8f87c01efd40847fe7a9ae106626048922bfff31

SHA256
61dc820fefe9feacced380111771ec2e68d3a5df318e2ad21fdd3c637944e364

SHA512
34ee0521bdf47b404029f3a5dac2a993bb4172837699047cb0d422caf58bad8a9d130464c035ef3cf5d22affcf11d1a153ec4e6698fbd4dd2bb5c643803facd8

Download Submit