9fb5268eec89f3239373b0f42da24c68452a495cfcc6f8c8f1edad56fa171436

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94fe2818cc01b48b0eee6cb9dd204f90N.exe
Size

51KB
MD5

94fe2818cc01b48b0eee6cb9dd204f90
SHA1

d25adcec227ca4b1bc7c68dcc70214cced43f419
SHA256

9fb5268eec89f3239373b0f42da24c68452a495cfcc6f8c8f1edad56fa171436
SHA512

abad89546807b3455780ad69be004716a98ba888c5e62b13a6a4008bec6bffb78243dbe29b380f3a8224797857180cdc2141affd06fec197c36e40389ac46594
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFXpK5c5Mbabk7c7zKc:W7ZppApBULcfpHLcfpyDA6uwzKc

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4623) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NetworkInformation.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp	94fe2818cc01b48b0eee6cb9dd204f90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94fe2818cc01b48b0eee6cb9dd204f90N.exe

C:\Users\Admin\AppData\Local\Temp\94fe2818cc01b48b0eee6cb9dd204f90N.exe
"C:\Users\Admin\AppData\Local\Temp\94fe2818cc01b48b0eee6cb9dd204f90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
51KB

MD5
777c1dbd55a5156fa9a1da1124d4c266

SHA1
ed730b845d9aef6fcd01069c9b639158ed35ed50

SHA256
d1429c1f532c0a45c5fb1b1a18a9dde47de2269c344e90a2c83c4b70480d026b

SHA512
2599d9d19d06daf36c016491f4263f4a85c4963756d49fcd4c3c928eb1206174a737a700a4bc6c922e64094f054773d4099a93419759cd4734fe89173c964e2d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
e516351364b9209103174a3dc80a3eb1

SHA1
da9d761d2a16916867ac2071202d5c44df4292fa

SHA256
27ba9eaa754fdc1691b084650eef2f3c5052810e0819947368d7eec7dd1967b3

SHA512
d20d325963e8843af106207ef40f7800d99e69aa3a096700355d0172497e4c44e001376cc65665d7b3f4db7d31a7e3e6f5004ff5e719dfde4a7eb2ef07151937

Download Submit