c9b7c097394c70549f8aa57f42cfb2cb599d8de488d239bed5aa30b9ac0e880c

Analysis

max time kernel
120s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

569285c9c9ee6f88a611cfa195aa0480N.exe
Size

72KB
MD5

569285c9c9ee6f88a611cfa195aa0480
SHA1

e9fd2eb3c41e19ba9c97b55d73adeb3cd9f4c023
SHA256

c9b7c097394c70549f8aa57f42cfb2cb599d8de488d239bed5aa30b9ac0e880c
SHA512

a6af1fe870f92123e4afe99c538fceff10c27573c3df52f859cc1e749c53e1816464b5c249330e31b7ec98420e7d6ad2ce4da7976a8b896f1ce7b11d62e63e37
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZvm:6NLWpCZIzjwHw0

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4631) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-BR.pak.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	569285c9c9ee6f88a611cfa195aa0480N.exe

C:\Users\Admin\AppData\Local\Temp\569285c9c9ee6f88a611cfa195aa0480N.exe
"C:\Users\Admin\AppData\Local\Temp\569285c9c9ee6f88a611cfa195aa0480N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
72KB

MD5
d95e67cc2e837b65c85c9f746d921931

SHA1
a4daef380c2bfc5b3718e7b452d8054949787e51

SHA256
24bfbbdc3571e709c0d446981c199a39bfc7d7b7e806e1afb58f789dec9da875

SHA512
8248a43d7e3babae21dee0bc13492255f5618411820cf117ccc778be93031a1d2d3db8a6476679983b3e498f86e09a44dc34d2f9f75281c874e87f78e1dd530c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
171KB

MD5
442eef898fdf1528e2d7c1cdfd2565e7

SHA1
74df3d35a6f64d5db087f697763710f4920f02ea

SHA256
b68de352ce7d7cabb61e51d3cd2d2585e7ee5c7cb7e87927f510376a2252c85a

SHA512
7c84c8cb0301e9da18c1b9c7e6d3947160dab72a05bb33049e8796c8d3ad8bcf68cea05dd6692b8b6bd8d200cf575a86888c411d96e620bafba6d2e3b560369a

Download Submit