dbba965c06e3b61600fe11d1dccab8193b940caaa5ce109028c7b7815844e697

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

806d1380900f45c7a06794ffcf2d6f50N.exe
Size

48KB
MD5

806d1380900f45c7a06794ffcf2d6f50
SHA1

ec8767e459d4426414b4c96ebf4503c1b7343b7a
SHA256

dbba965c06e3b61600fe11d1dccab8193b940caaa5ce109028c7b7815844e697
SHA512

ab82856adbacbbbcb83d45485d4f204a6f89ec0759635bb5b81ecb204647be01201ec82473d0ca50d6f8c8a202899ed0654b3787cd854dfc8025342b50d1da12
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFXpK5c5khwRDThwRDiu7uG:W7ZppApBULcfpHLcfpyDA6swXwD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4643) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sl.pak.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxcompiler.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	806d1380900f45c7a06794ffcf2d6f50N.exe

C:\Users\Admin\AppData\Local\Temp\806d1380900f45c7a06794ffcf2d6f50N.exe
"C:\Users\Admin\AppData\Local\Temp\806d1380900f45c7a06794ffcf2d6f50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
49KB

MD5
de7e73f2cdd5050ecc739720c682ff0e

SHA1
410320564052c6a1b07e49a62aefb3cfe2550bc8

SHA256
a4b74650d06444d383228343b57ade932c19b3a60d9df2f0df6f3c932047e303

SHA512
fa64ef6f682fb68934c9ce2d575879f96f338fc5148ce5e3655d5ccfe064cba73603ae38301a1f3664d3c74e37bd50b8bf39be235121cf50ecf516550bd1e58c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
8c94ef6a37b1cd64d07cce4ad60b2c6f

SHA1
69ce57f168c2247e32e51049722b1757f0a42634

SHA256
314b10625de09457fe7b94b5465022cbb9f5ab4a795f1b58cb8763205ee9cf68

SHA512
26c9b45d8f212676ba6fc64ab25005d740a368e05bdc27b5359c2aeee4e6a44106429f01d586516ba53d90b157ffdfb7447e18ce0f09bed433e222891696677e

Download Submit