4a23a47a752a81cfee8d291b245a94a515df4189adb65af0ca435e2b1e7e4360

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f0907e9e921d21614a267cfe250b0290N.exe
Size

51KB
MD5

f0907e9e921d21614a267cfe250b0290
SHA1

e98b831345911235a77221975353a71aee80e2bd
SHA256

4a23a47a752a81cfee8d291b245a94a515df4189adb65af0ca435e2b1e7e4360
SHA512

5081b5533aeed0d2efc878fd1890ad9aacdd8304bbff1277933d2c1a453d6de82293049dd7aefa356fbd3e424035ab085d69b51103764dc5bb7809e167be552a
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw1VyjVy/VeSv101k:W7ZppApyVyjVy/ESh

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4645) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Primitives.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	f0907e9e921d21614a267cfe250b0290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp	f0907e9e921d21614a267cfe250b0290N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0907e9e921d21614a267cfe250b0290N.exe

C:\Users\Admin\AppData\Local\Temp\f0907e9e921d21614a267cfe250b0290N.exe
"C:\Users\Admin\AppData\Local\Temp\f0907e9e921d21614a267cfe250b0290N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
51KB

MD5
abb499d81255661570cce990a58e428d

SHA1
73519ac2dd9d6cf6792a657a29b1dd4e2054ad1b

SHA256
7de5f45f266525e1e5e99fe67ce330c6f1652ebfd4c7097d2fc29dae83f8b26b

SHA512
eda3ed2bd2ddecc507f2eaa2a15fa29539a5afd4ab170db35df54d2dbeee730d6c33916fe2b5d3e4aec1cd93baa8ab43b861356d27bc4ee2f1acf8e429720ef7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
6fa8f87e6416847936b41f3953c31d91

SHA1
59c6cf7717fb1abf24d42c3de9ed0525c8a38ed4

SHA256
7b0b548167f127c2a0a43053a5eaeff9c466b676e73f2d8140bdc57f58e54b0a

SHA512
2744b2595eb0c9541bc58f3413982f543ac17a5eb2681a3acb3336c4da0ea1e2816b91de8d8fb91331e271fd7466d2a8641c2f6338d2ea03e5e56d14b491d322

Download Submit