5e1a4ca71fb631d18f6ad93d6aa1785c6ac1da9b77059801ffb800f272fba913

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d66574c959fe20eb13f4fb4867a1d630N.exe
Size

48KB
MD5

d66574c959fe20eb13f4fb4867a1d630
SHA1

c2e758c33c76a59587ab76572eebe121b719e4c6
SHA256

5e1a4ca71fb631d18f6ad93d6aa1785c6ac1da9b77059801ffb800f272fba913
SHA512

f62f46df77ff610ac64149049d04f88c5952def89b26ff1ec9d9a818c03a3e16b0284e8422b77788a63cc65d24f49f6f6b56411e89292b38a0a68e2ecc38b304
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0Iu2U2igZgj:/7BlpQpARFbhNIiJwsJwwnZwgZgj

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4664) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	d66574c959fe20eb13f4fb4867a1d630N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d66574c959fe20eb13f4fb4867a1d630N.exe

C:\Users\Admin\AppData\Local\Temp\d66574c959fe20eb13f4fb4867a1d630N.exe
"C:\Users\Admin\AppData\Local\Temp\d66574c959fe20eb13f4fb4867a1d630N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
48KB

MD5
7d930d1d70c691a367fcb08dde13de14

SHA1
f2eb1f45f8cb335ca33581c4ae4b445b5f92e4ec

SHA256
8365e82f828ad340370e2b5a65c1a73f907ba3afc8a6a5aa56d7a019a0ff6984

SHA512
0e75a8c1b3f815e7a351a8b3696eb0a749d197b8a97a3051e1be2b7af603a0ebb5d4000a72ddcd9e1ee7aba4befc26aae2a22ca356865fae9344788dbf0f72c7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
38068c1cc181085bc0c799892a30c589

SHA1
2021202ea2edd1c4db0172f2377c8f1ac0a98c02

SHA256
4b89650d84bf8d70e590eefd752350e265a0be628233969a3307857272d99d10

SHA512
c62519566dbedac621c5c101aac9ebffb8a46c5036e831770c41aeab934888149c90fbf8780a03afea3e521f1796313697c67793f6ae8ad9fd7daae465bb2892

Download Submit
memory/916-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/916-1004-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download