9e9269b2c5b44fdad69567f03a6c9f782e51ecc632faeb6c76e32bbdb90e9a96

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cac2127e9cda75f69d7d77d9b222170N.exe
Size

68KB
MD5

6cac2127e9cda75f69d7d77d9b222170
SHA1

fbe0bdf5805dce5fe9ead62cd70e46243a161207
SHA256

9e9269b2c5b44fdad69567f03a6c9f782e51ecc632faeb6c76e32bbdb90e9a96
SHA512

d0a51df2121b339bb93c57bdee1aa05c0d612446fa8ce1a971a417f597a98178eeadc9ba94004b6ae917b7e5a4498aeb826bad7122c7ef3da51b4ddd7594222c
SSDEEP

1536:W7ZhA7dABJJZENTNy3MTW7JJZENTNy3gOv:6e76BtEuTtEuF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4636) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Common.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\eventlog_provider.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\LICENSE.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sr.pak.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es.pak.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp	6cac2127e9cda75f69d7d77d9b222170N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cac2127e9cda75f69d7d77d9b222170N.exe

C:\Users\Admin\AppData\Local\Temp\6cac2127e9cda75f69d7d77d9b222170N.exe
"C:\Users\Admin\AppData\Local\Temp\6cac2127e9cda75f69d7d77d9b222170N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
69KB

MD5
dbbd6bdf6049ae5ce2a2ec0d9f06995b

SHA1
5b555f19bb84ddce3c540aa2999ec89080b94fde

SHA256
cd173d5892bbe96af6d0f39872e94b934054aa7f87220f950185cab5cf404ef7

SHA512
cd639660d7eaf0d648f3c990afcb6b52fdb0826a107fa5dc526feaa4272dcce6c875c102d69326c1c3d0ed4f23a3e34924b3885fb874edd1d1b5b79c5ab2f3e9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
167KB

MD5
05187522bfa430bba0529a7e2d17c6cf

SHA1
400237dad518402975b4caa75a598d134328ad92

SHA256
ce0d5a1c48ea3871262b7b10e7e0f7914944f01445ee76a52da0cf792f6e7f94

SHA512
88ab8cb6b11c5bac370bfff3febeeff2a4761f9b6f8ba260f74f11ba8410f1fdf9c408364aca43357bf9567b21f2942d7349324b57df1eee3eca8f4abd8f3dec

Download Submit