01d05b85cd4d58c300884b11be441c05f0cac0e5d1fee2a22e9a8fae38b2cf81

Analysis

max time kernel
119s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6affd509a1b6396059203c6cb449810N.exe
Size

62KB
MD5

c6affd509a1b6396059203c6cb449810
SHA1

0b03e66828f13ad90e1e59e5b5243e4dcc2cc46a
SHA256

01d05b85cd4d58c300884b11be441c05f0cac0e5d1fee2a22e9a8fae38b2cf81
SHA512

fc71152574cd898f9781ca3a10accab484878a2f96f641c2f31aec1c92a00b52ab5408ce7342cd9b5653612c680c09076b53c99084cc02544f3547ee931deabd
SSDEEP

1536:W7ZhA7pApw03vR03vxSKSWu0SWuM28pJzpJc:6e7WpwYRYxSKSWu0SWuM283z3c

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4663) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\amazonredshiftodbc_sb64.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	c6affd509a1b6396059203c6cb449810N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp	c6affd509a1b6396059203c6cb449810N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6affd509a1b6396059203c6cb449810N.exe

C:\Users\Admin\AppData\Local\Temp\c6affd509a1b6396059203c6cb449810N.exe
"C:\Users\Admin\AppData\Local\Temp\c6affd509a1b6396059203c6cb449810N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
62KB

MD5
5f0dc0a40fc2f18e79b0d5b58724a38d

SHA1
90c31410950523e7d2985ca930e46522c549bd05

SHA256
0ab7e7d78681ad484945c0fffc5a94b094bf1f4b1993bdf38b9061965c221eec

SHA512
0ebd8299ae9ed58fa48aebf91e82f4b793ab0bc191c61d9b99ce4c8e37f5f606fa8e8f9e84cf18dc0fd503b95187993fec2e1d8a5df52f1e2a39f98451c13715

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
161KB

MD5
84b8f436645882683be73ae300e3f4c7

SHA1
ccc0b34d8426aabdd6e4bb7de5d4cbd8870953ad

SHA256
ff36fe56c5da42121825bf0f004ec6d6ed4b61835018cf5d81a5fdc46898ee4a

SHA512
00e4da3871497ca312e7afb32941e7d166dcb6ff545a247360f1ec4cab46cf29a7449c9dcc0cf2a15f2abcab8d379993ab745605ce49bf8ceaae512623c88d2a

Download Submit