46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
Size

46KB
MD5

6349e065fd95101983512a5c6972aa95
SHA1

03dc75d759334802e02ce288e264218ecbd576b6
SHA256

46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e
SHA512

94e46569d2a3f11c0dacffca015915c25d49b972ac1868fb1c2964bcd086dcca1432aafe0a6d06fdcfe57dc2f0b75dc84dbf2f1f4208e13526387add3a0d4402
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFXpK5c5S2Y8/32Y8/e:W7ZppApBULcfpHLcfpyDA6Z

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5123) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fil.pak.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql70.xsl.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.dll.sig.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.exe.sig.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe

C:\Users\Admin\AppData\Local\Temp\46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe
"C:\Users\Admin\AppData\Local\Temp\46983066f63b828f0703f5d94fe2b3ad8f6605e1a19202dc2b5f83ce7959cc2e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
47KB

MD5
dc8a8c8a738e9a766f33e2fedd9f0620

SHA1
9dc4bc9d5b7f6c76d0e631953bc15a0092d8f6dd

SHA256
9b704cc10c5f5bf213aff6dee257afdb5464b14fdc02b462957d6a000acebad3

SHA512
7867fd43850628931dfbdbd9a4ee8d1984b82f8be5d2383661947b82b741aff7c4dbfe448fc665374759f9540a0829f0a432431508177a4dd51e2aaf775c303c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
1ec983c70c18e08aa2aaee8f89cded4c

SHA1
cb7550a12db9342883a48e24cb56f2b52c14bcd1

SHA256
9defd9063a44eadbc1fb351a62752e2828416941f0458bd65d4fcceaa9f27b68

SHA512
6b662cc0d0075e37abfc507cf4dff644b19051056da5315097537cd99d0e3627c07a1b1d73628fb4c43ec7fdc43ebcacf323e9d0bbca28ed3e1507bbeadf86e3

Download Submit