81958117677b9a4b3bb050122ef76aa655b66b92e7c4144585c4fcf3b8cfc775

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d43424423bc6bf8b94585fa40aae730N.exe
Size

80KB
MD5

4d43424423bc6bf8b94585fa40aae730
SHA1

c48dccf50a3ba6036e96e212cb60973195299edb
SHA256

81958117677b9a4b3bb050122ef76aa655b66b92e7c4144585c4fcf3b8cfc775
SHA512

95db1d536819bc3b6ef5f07441bd62fd08d0e45386290be30a475ffcea656d0afde08b33b6965706f4c76c99d6c38ea17771010d87fa6e4bb01f2bac4aadb081
SSDEEP

1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlcJ24:6e7WpRaSljO24

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4629) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ta.pak.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Diagnostics.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\deployment.config.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	4d43424423bc6bf8b94585fa40aae730N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	4d43424423bc6bf8b94585fa40aae730N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d43424423bc6bf8b94585fa40aae730N.exe

C:\Users\Admin\AppData\Local\Temp\4d43424423bc6bf8b94585fa40aae730N.exe
"C:\Users\Admin\AppData\Local\Temp\4d43424423bc6bf8b94585fa40aae730N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
80KB

MD5
789538514cc29978d2554e5894d306cf

SHA1
f266095d758a9c8e73ea8027a8b4180a30276ac0

SHA256
dbbe0191602407d5d03d5a62611f3bfb04fe852d0261ac5cc0c0942f4c460338

SHA512
fe5f9a64e1a35a2eec550e1a57225d9f90509c7e9064ef221d4dab3be6a442a3f494f71f7ff99ff8add438e2ec0f866b5b8bbf342e1dddfc5dea96caefc307c1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
7f1839a23eb1fd0e5178046bd1e68834

SHA1
ef64a6bf69b28a46754eb75b2f6dc8352d504dd3

SHA256
7c79ac4019716c36577b4035743c55b9a83c478ba32f183f01c843ecb3e41076

SHA512
145964bac2bfb9783725118b92e5a642e7e5755c0b363f0ea977802d059f1e73fa68ca0acaf86e897dac5fb3db7b10e9babe9b1a45c60c024657967e45b38cb5

Download Submit