3723657cbd7042dfdf4d10321141082ceb75b9fc45d9e4950daa1dd76b45e754

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f19f57d4776141262e4d1eedbef0dc60N.exe
Size

53KB
MD5

f19f57d4776141262e4d1eedbef0dc60
SHA1

e928e5c1ef05ad3c657db2fd26a0fc85fa182dbd
SHA256

3723657cbd7042dfdf4d10321141082ceb75b9fc45d9e4950daa1dd76b45e754
SHA512

e87a5ba971ce12f02daa296d550fb6551d568fd6186e674c4bc2bb06dfe3d3504954a786359e694fd14297a8de898bee501ced94c1f758433b322a3c87de760e
SSDEEP

1536:W7ZppApBULcfpHLcfpyDoAQeLeAeLeJ0Pnv:6pWpBwchcwDqnv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	f19f57d4776141262e4d1eedbef0dc60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f19f57d4776141262e4d1eedbef0dc60N.exe

C:\Users\Admin\AppData\Local\Temp\f19f57d4776141262e4d1eedbef0dc60N.exe
"C:\Users\Admin\AppData\Local\Temp\f19f57d4776141262e4d1eedbef0dc60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
53KB

MD5
daae9e0e40704ec3a00573a47e30b169

SHA1
1f7aa8f45c34e4a8e1350f11e283f766212bced5

SHA256
5ac8fed0ad751b41f065e9de7ff61766c9e352f60473458dd4715bb89527c9b9

SHA512
f66fc4d7ab3acffccd7d0742f26f3c71fdcf2b9f3845378a4dfab95d85570d1c136695d7fd7f27dcf87830f1026b60d4e2cd54fb20326ec39f06728239898041

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
57ebb33e2f85cf812338a456c6814bd8

SHA1
9be6f53f2850535c2d1bfc160818492dd1bb3deb

SHA256
274853fe90cb94c85159e0643121f4960eb1106589e3c7aec862fb53a299e71a

SHA512
88b26cc25d39af0792868fcf97026f2cdbe5f103c3a11cc6d5cc00f752f47bd7e96e5403e014e61627633339c7871dd48e0090b54b9b7eada9fa396f931806df

Download Submit