da21ee703a09dc1e2a06d47bf7afd486b391844366235803e63cf5b6f8535cde

Analysis

max time kernel
120s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c69c13c20fe6c8ab50121f32195eafb0N.exe
Size

45KB
MD5

c69c13c20fe6c8ab50121f32195eafb0
SHA1

59745bad79238da8f8c648ac5fd67b53da64932e
SHA256

da21ee703a09dc1e2a06d47bf7afd486b391844366235803e63cf5b6f8535cde
SHA512

19f52ad5a3de0a8f2ea0cf6184e6c77ab94062acbfefa20be85e9d3e05e9761d71ea8f7768413a41372908e26ba37a9147bedaa78a50c8e70d26055d7b89fdaf
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFXpK5c5khwRDThwRDN:W7ZppApBULcfpHLcfpyDA6swXwv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\management.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxcompiler.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lv.pak.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationTypes.resources.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	c69c13c20fe6c8ab50121f32195eafb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c69c13c20fe6c8ab50121f32195eafb0N.exe

C:\Users\Admin\AppData\Local\Temp\c69c13c20fe6c8ab50121f32195eafb0N.exe
"C:\Users\Admin\AppData\Local\Temp\c69c13c20fe6c8ab50121f32195eafb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
45KB

MD5
b8f9046aa8710846fbac299a2900b3cb

SHA1
c790a255e1c6f39117578bec6073efc081187077

SHA256
4b3b77d796c1a5e154ce4b6327e0f99a37668089eecb7a50c31f3d509d2e1548

SHA512
1a8cf1da78b6076e11bb89c97c686a7bd709ab6f769cafbfd09a7f22be653cbeedfa2064bd2084000875733ba1205937355fd6e7ff6c418e9d68fbbfc69c2acd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
8fff277d24a54f064e9a20fbf30792f4

SHA1
bab9aaec4922b1f930e47d8db4c2af0c6bd92756

SHA256
c2c03c1ed93dba18152ca17f69489b93a99d1d146ce11be38c2d6de99e5aa171

SHA512
badc6dd7a7fee2d5dc52c4189f6ee4486f1efcf9e601cdd52e867c90a8e716fd43ecbb88d5d4cc4953577e00ddc8a887e3a4384c543d3801e300e97ad2b2682c

Download Submit