ec6082ab581498db0c921c6fe43c625b9d8a66869a6f3e42e25b7d45bd5da990

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

954ca6466028eca8d80e7b2ee1c85e60N.exe
Size

621KB
MD5

954ca6466028eca8d80e7b2ee1c85e60
SHA1

ecfe9019cfc51478640ca570f575c56e3e986cec
SHA256

ec6082ab581498db0c921c6fe43c625b9d8a66869a6f3e42e25b7d45bd5da990
SHA512

d1b3077385fc615b93f629d069859c25f6a23d2f570e280c0ece6d73c794cf0be6d3d93292973feb74a3ce4c9dbb85aa6a7855fc85e282ae65aab94d002b8477
SSDEEP

12288:Ck2ZkNvUKvWAWmIJY/83gai1hr/+IRdyC3wy7c6V0wR:CvumKDs4801RIC3f7c6V0w

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2303) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XDocument.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\AddSubmit.ps1.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	954ca6466028eca8d80e7b2ee1c85e60N.exe

C:\Users\Admin\AppData\Local\Temp\954ca6466028eca8d80e7b2ee1c85e60N.exe
"C:\Users\Admin\AppData\Local\Temp\954ca6466028eca8d80e7b2ee1c85e60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
621KB

MD5
8f1ffa2e6a6d576d7fc9b14a51a60c8b

SHA1
798929264723cabda024c4d44a64efff886dfde3

SHA256
865d0c63ceb6d54a9018fa9d63b793a705ae7f814c9a65d657b2cca134f1f799

SHA512
69b0545ba524a682a2950ee285a86b7a22be17cb850b9790a85a3631b453268c6a69c427cf0f9376af51bbe656d8df1fa8d74a36a0753f01e7fbbe099d8e5cf4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
720KB

MD5
c0c988a4086e7673848edf90bf4f3db3

SHA1
8b9b3ff2cba3a37fefa26d34b7fe51ea1b18f35b

SHA256
4b57b416ebc3a627f7f379a14dae5b66e210a0aad3a1dfdb71362dae802405ea

SHA512
e6a7eca49ff9b466105c8239ca21253db83816fc086cb0f7d483efea30c0955c1399362958852338ade57542804423af90675a9133b428e6d96d7d8eebf35425

Download Submit