7d5f90dd78c91358d536b6641828e900ada40091bd6557738d5792dc4c55d00c

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 20:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9961328ed210b0f8b6359818beb5dc00N.exe
Size

78KB
MD5

9961328ed210b0f8b6359818beb5dc00
SHA1

bdf2e13a24ea46b84826a300f0ad470bcd22f1f9
SHA256

7d5f90dd78c91358d536b6641828e900ada40091bd6557738d5792dc4c55d00c
SHA512

cfb51510b9ef71cb719b0a1dce71236ed138b56b5dcb752d9877fb4405cf732008d1470aa29f1fdd5e31ee50677f7a98417f88c96914490f57ee386411895524
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEQ:/7ZQpApze+eJfFpsJOfFpsJ5DLkv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4622) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\gu.pak.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\id.pak.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-PT.pak.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9961328ed210b0f8b6359818beb5dc00N.exe

C:\Users\Admin\AppData\Local\Temp\9961328ed210b0f8b6359818beb5dc00N.exe
"C:\Users\Admin\AppData\Local\Temp\9961328ed210b0f8b6359818beb5dc00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
78KB

MD5
7d61e7dea8b594b55961145e320f525b

SHA1
ec2152decba26c2f6b70307db735b222db6f923a

SHA256
ad9c579319fb39cf7bcaf520d4922010146ea23e60d77cf0c3a164c1c89bd6db

SHA512
7d1803d90e0a770501029ef321b9acf76282fc8cf4285beb9d7353911a4b0d5443dbebb8ecdb1db38753088407fb6c7542b3ff33874aafc3785c25196e2af027

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
177KB

MD5
ac2596cab38d480f7f8b57b72db19cc3

SHA1
a0814efb2abdd46e5d1a794d9baa39d02410a995

SHA256
810398cf2ac1b18e1bb8a1b724d94b6a16b582cdbef5d8d23dd1b10076b73e26

SHA512
6d0d7ab3174de81bc0218fe6fad6cec527bd8df28bc5aa9c61516c66c042219ccf658e2e1cf37c711eb417e4880a0259f9362f026d70149d6f455c75101cb2e2

Download Submit
memory/4664-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4664-854-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download