312aeb6d2e836a6bdbb4a9bdad1b31691e8dc5516aad98b36d4d3f14c5711b85

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4662244910ed9ea2b13cb1a907c444b0N.exe
Size

48KB
MD5

4662244910ed9ea2b13cb1a907c444b0
SHA1

393c2d5ed6ef905226974384be33da056ed469ba
SHA256

312aeb6d2e836a6bdbb4a9bdad1b31691e8dc5516aad98b36d4d3f14c5711b85
SHA512

87ba46c1ad1c81aa172a5878c7830a2fb68a602863cc3010ac5bb010e670d86e31aaea8064acef96ed6d103d467f6ac5652be9608d40f84390f22f5488bb34e7
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltIIRIy7Blp:W7ZhA7pApM21LOA1LOl6Ad7Z

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4648) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\management.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4662244910ed9ea2b13cb1a907c444b0N.exe

C:\Users\Admin\AppData\Local\Temp\4662244910ed9ea2b13cb1a907c444b0N.exe
"C:\Users\Admin\AppData\Local\Temp\4662244910ed9ea2b13cb1a907c444b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
49KB

MD5
2a8549da359fea06d024566dde829367

SHA1
5d2f03ee358c37cf745c4969907e0514a407699b

SHA256
3dc11745cc5fa230132d9049c04d1e488b4ed5c9e8cbfcf143f509aa573b2e44

SHA512
f8def931f9b0b1332b133a81143b058ff6e9a91e52534339ea540a7e4bbc7f23a1d98c045a68f097e152a77af491405cc909317f91db5ad3aa818c74a71dc67a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
265b0515dfa29ae2badea02cd407fef3

SHA1
d9aaeb92b25c5985cb402426cab177a34cf215b6

SHA256
ffde2120cc6c98bac89c153ff45db5e8c160c35c9632717a7dc12b0351e56d52

SHA512
6a1a03942ade6dada066152281d2410297ae13a2e3c029a36d168b2525a0c232e512e78783083dba48cc079015198861a430ef5b6cafe0dc09a31f112a5f0199

Download Submit