85184260d43c7ee82b54a6c9d961ce6cf806e8d2e949cbc8dce694ae4c0df0dc

Analysis

max time kernel
120s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd45a525cea0889f16526b0ce39b0480N.exe
Size

54KB
MD5

fd45a525cea0889f16526b0ce39b0480
SHA1

fb45dd0d006a0d248f904c12b7e9ebd62816d442
SHA256

85184260d43c7ee82b54a6c9d961ce6cf806e8d2e949cbc8dce694ae4c0df0dc
SHA512

ce2c9e46f3a09e5eccd9d1e9cb98e5b105a0d732bb3075016d9941deee8a0c1db4e273021856aa075cc2693063b65e407c640ec8cc550879f3bf3189211d6196
SSDEEP

768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJWX0kXX0krDzgpQZ+zzgpQZ+RElE+:W7ZppApkGpaI4RElE+

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4645) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd45a525cea0889f16526b0ce39b0480N.exe

C:\Users\Admin\AppData\Local\Temp\fd45a525cea0889f16526b0ce39b0480N.exe
"C:\Users\Admin\AppData\Local\Temp\fd45a525cea0889f16526b0ce39b0480N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
55KB

MD5
f192dff6aaf0e0fddee9e97f5e776ffa

SHA1
d9e77bf1c2d21d45be4582f8fb5e993846295b45

SHA256
3dfb7970d7a5322e451d805c7d26c0f63796998659a1b806bf2fab0461166f58

SHA512
ae71c593ff83a8d068e1fbc5ca59715f986f951fcda71eda99ed94a4bf259d153f357d2e142e29ebfeced9b6928892dfe8ba2f039bb37d7eb9aed7bfbcf646e4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
154KB

MD5
37bbeacf743f4e06f536b42ec3e193cb

SHA1
78279256140f50bd86cce5f397b117031a2c3525

SHA256
b05b8fe7c569b7664eda124a515b1456f49dd4282e17f4b24c486c78312e0f30

SHA512
e1155813c9070741a6a8b9ca397742b64be9f4d761ce4b05efa05a9c49688f68977f27a77c40cec87fae02d524ab71f432091c923e7ee2130bfdf3ed65f5855c

Download Submit