6d967da7c86c5853aaa6976d0e70bf2682339d0468d3abfe8116a257317f2376

Analysis

max time kernel
120s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 14:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c84f7dc57381e6b5a406c58379009230N.exe
Size

45KB
MD5

c84f7dc57381e6b5a406c58379009230
SHA1

35a1c6d5ca7e67d16c8d7987406610fbf8c0b0a9
SHA256

6d967da7c86c5853aaa6976d0e70bf2682339d0468d3abfe8116a257317f2376
SHA512

669f770ae3874cf14df7d0e64c170b7681c241c789e83aad79bbd29ff3c8671647d84e4d8d49768a55b221d5d88ba7731519b5d97be7b171107fdc3902b6ba40
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FzzwzYYo8F8S:/7BlpQpARFbhNIYYo8F8S

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4652) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogo.png.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader_icd.json.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sv.pak.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	c84f7dc57381e6b5a406c58379009230N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	c84f7dc57381e6b5a406c58379009230N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c84f7dc57381e6b5a406c58379009230N.exe

C:\Users\Admin\AppData\Local\Temp\c84f7dc57381e6b5a406c58379009230N.exe
"C:\Users\Admin\AppData\Local\Temp\c84f7dc57381e6b5a406c58379009230N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
45KB

MD5
ab69266c07b34a33495967cdd547e9fa

SHA1
7817c3715f952c17fe7c004edb0eaa9773047135

SHA256
ab3cd77196144eae4022fc53cc1eb4754df8a8c52c2b68e16d55a2dd2c5f9e3e

SHA512
2f1decd8f6188a9a75b569b61271efa144f48c442d55129e297d2ba69ed373746e8730924e8d414aed8ff640eb3148e8084d150cc6583b63465f5daf24ba5930

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
7190a2e9a1ac897ef8d2dd30a65f6b17

SHA1
c85d95c080e163c3543979a8ca5c0cea719bde4f

SHA256
705b9db4f7314d29b97f66e2c1cfc8fba2f6f638a070eaa46d251f0657fb6909

SHA512
d4ecbd7af9167e2af5bc14bf588473e07c33f0fa6d8852d2b607bc9942aca7089a2f4f872b054395e0ab640deb9015427a23e60bd5c4f45403b9131c20f35444

Download Submit
memory/3844-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3844-882-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download