d0040f918dbd083338192849a24f0f26065fde178bb8f71e486d61d21ac0b679

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 21:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4af9958715bb29db1aa39fefd0dfbb00N.exe
Size

94KB
MD5

4af9958715bb29db1aa39fefd0dfbb00
SHA1

a1d7a7af2e7b1664775e7aff0aad7344a67c8fb3
SHA256

d0040f918dbd083338192849a24f0f26065fde178bb8f71e486d61d21ac0b679
SHA512

c6061db71a19e4fa3ed47ee57df7f34cafece3049d839a8771e5d617348b738b9995e0bd391f4a47de2d3eafef5e9f2f5263a5922d737892de96c11fdf51c75e
SSDEEP

1536:W7ZhA7pApH9QHwtRF9ESWu0SWujodsodaNovTW+SPL+cycWAF689ilYp/Dop/DD:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9S

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4371) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.exe.sig.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\net.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	4af9958715bb29db1aa39fefd0dfbb00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4af9958715bb29db1aa39fefd0dfbb00N.exe

C:\Users\Admin\AppData\Local\Temp\4af9958715bb29db1aa39fefd0dfbb00N.exe
"C:\Users\Admin\AppData\Local\Temp\4af9958715bb29db1aa39fefd0dfbb00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
94KB

MD5
b4f3acbf99a23e01d57c3cf185bde850

SHA1
80d9331aeefe64fb2af0ba5381f6ffd94b7eb6fa

SHA256
dc6bdd405d234f5e73eb097013092aa7befa7647d27984e7133d42218895a679

SHA512
1e265711985d52e723646c2fb96ff7180257081ca52274d44b4afad95d40e60d4bd8c3b77a52322788198f3213c9c8f216930576cca88569b921861eadda3104

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
193KB

MD5
0e48ebdc857ac66e5b46b7a751ed13e4

SHA1
d27b1120816941a47c28e21639ccef5cc49123e1

SHA256
13679b10f558dfbdf8846ac9020dc6b8a3efd5853c838f9cd05261a07098731c

SHA512
22c58ebb23125db9823eeab9624f0f98136f05a93386e9957a4d2219748bca3989ac1085521ab54b32c65ca424e5c3bccfe73728cf01ebbb400ffc3671bafe00

Download Submit