f1330a9287ecfb0c7c71d376cd2c6e6c6f6d9749a00f722785461690909adc75

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
Size

45KB
MD5

cdc1b63b1aa9a9cb31c7e6347ab026e0
SHA1

fad886f56bc7b24891210cacf74f76b377e6da95
SHA256

f1330a9287ecfb0c7c71d376cd2c6e6c6f6d9749a00f722785461690909adc75
SHA512

8a944fdc427d1a5c1842339665ba304d2d206e6db626ce7a83b3f225994c81773507eb5f77d00369993cbd7c4c7932799d5b4cf217b361c27146ae19dc1adc4e
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLid8dO:W7ZppApBULcfpHLcfpyDN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4650) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jni.h.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe

C:\Users\Admin\AppData\Local\Temp\cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe
"C:\Users\Admin\AppData\Local\Temp\cdc1b63b1aa9a9cb31c7e6347ab026e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1036,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
45KB

MD5
8ff8f69fbfb922d5cd7180bfdc558b4a

SHA1
7be024588882427aa6912cbb07c69dbe55bd414e

SHA256
11533bc2fbe3718453f58857b2e16550be2f3d9b5dec8ded5e6c06ea1f8150d1

SHA512
6719c32f9d70d759befe9d77e659092212c54f95ad222a0d1d8dd32a1420e7b93c889094d774a301e0a7da3e87a70e74c0b6ec7cec42b1a63e7203341b4f419e

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
157KB

MD5
5f8e8cb5b3634fa7113e51be2e1e252f

SHA1
72d20666af5e17d7e4c5f40e6a487ab298abcad5

SHA256
afac4af507a9ad5649fdc1cd26db46cfba7160c35e74d8c3acbc96867cee3045

SHA512
8b1551c2c9563004177f3c67a642f77b5bfff644960a29a705404db6993e77f0eb07845f0801de0e7a3bc3ae01193a2450fee1f0b6232ea2f921e389429a2464

Download Submit