2d9fb6acd34abf6f76ff6e0fda020b36480cb89a5341e35b41d791177f522054

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90dc7c865a1b00f17d36e90bd75fd060N.exe
Size

46KB
MD5

90dc7c865a1b00f17d36e90bd75fd060
SHA1

c8cdc8faf057d77871abd3b18a93118591fb5dab
SHA256

2d9fb6acd34abf6f76ff6e0fda020b36480cb89a5341e35b41d791177f522054
SHA512

c879f74345ff1da5a1ce4d13b22f66ab39556ee46728b67b7fcf46c09d8f2363b5e688f211219babe08e433cb48201e738ab3f5974109bc9f071217b1e2e9451
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c53hm5WTWk:W7ZhA7pApM21LOA1LOrtkpt6u8Kk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4657) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Controls.Ribbon.resources.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll.tmp	90dc7c865a1b00f17d36e90bd75fd060N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90dc7c865a1b00f17d36e90bd75fd060N.exe

C:\Users\Admin\AppData\Local\Temp\90dc7c865a1b00f17d36e90bd75fd060N.exe
"C:\Users\Admin\AppData\Local\Temp\90dc7c865a1b00f17d36e90bd75fd060N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
47KB

MD5
cbb17d2f54e7f4c83a572ca1e9ba9bcb

SHA1
73d544e2ba88f125c617bbc8e4b8bb80b82a3808

SHA256
3d98e32d09ee3441da81d7f141a7588ac0f65dc4a2d2999f0a1ce352a67da6e0

SHA512
0c0d763c7bd5f5ea10c1b4c2c0215a0b27963682b9965266b9aaae48cd94554693e91d8b1d3cad71f8cbec370f2522598400b9c6ec266ca85fdd788ce0652960

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
81b02cdeab07ad73b9ac06cd7d292e11

SHA1
8d72773c1ee733da305a0151be72ebf51c9910dc

SHA256
0d08ff192ff59f05a3681ce6298751452935943ac6dbe7d70cd47e525ca17499

SHA512
f89aa976ec2191d5cce02290c2de6b4ac7c2d7aa00e453d93166c2e21cfbda54cb0e77658e10c01e3c942792af8ea1f3955c0a8aa7407e5079ae65f7773ca956

Download Submit