9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
Size

80KB
MD5

1224a6e100e03544a5d8181355b3518a
SHA1

7d8322eb9375bcb429c7a52dd7d279157e667f69
SHA256

9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d
SHA512

6741d39e111ce4fee871b3b403dacb556f20ee4a5a28355048ee49313e4d3c2960ac74d7bd3b54aac5e817b8cc1ba26731c159b40cb83b55c685cff0fe96ab83
SSDEEP

1536:W7Z+pAp2nKLkx6p6cUOUOvnkJOM2kJOMU:6+Wp2nzMndD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5026) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.DLL.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Tec.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe

C:\Users\Admin\AppData\Local\Temp\9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe
"C:\Users\Admin\AppData\Local\Temp\9d340952fcfd5331163ebfb76d10adc7aeef64b0a0d7146846635a736a47dd5d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
80KB

MD5
0a4de1c9c15bb573f2c20166b9985462

SHA1
4553ce4fdb58427f9201ce7db4165d1781f17d04

SHA256
748a6191cc7403cdebb6ab653a05c05e92c78f18aa8ff3005a8ea862dfc108f8

SHA512
6bdfa88e5c03b50bf20499877af7f361a23a5f4533753d461afdd9f91a662ac12cb460a4e25b395ad5fba66ecfae3a218974f5d44a607cd9b44664198bb91af9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
811e5a9ae009a4d2e2534d38a4790b35

SHA1
22b35185954a5dc5a6285c54c5e8b158278d6166

SHA256
cd3b730a631ed888171653d5ae612abb35e9bdb567272b05f8410abeaf87b674

SHA512
09e5c720f751772d5ac7f6781d728e0aaca98481efe8a91f1cdbc2f4e07b7b2ff526804beee1d86a4bfe16d45c733db2d2267fd54eacd5f424819a0bf4fa537d

Download Submit