144108d623bdb668ab341248551a89de38832e84a12dac2ba62c3b911781a535

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2cab00d59076575c3308a637ebad4540N.exe
Size

41KB
MD5

2cab00d59076575c3308a637ebad4540
SHA1

52dbd6edc022528f5795640854e0c8f3ac375810
SHA256

144108d623bdb668ab341248551a89de38832e84a12dac2ba62c3b911781a535
SHA512

032de07a45e4adb310fce7cf1ff9ef3b0f160add25ab794e82e23595034f52856d8ef646b3e497f28b017521db402f53278ccc9da98b5f96cbaf258602068896
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLhX5YYj3X5YYj4:W7ZppApBULcfpHLcfpyD45Y

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4688) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	2cab00d59076575c3308a637ebad4540N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cab00d59076575c3308a637ebad4540N.exe

C:\Users\Admin\AppData\Local\Temp\2cab00d59076575c3308a637ebad4540N.exe
"C:\Users\Admin\AppData\Local\Temp\2cab00d59076575c3308a637ebad4540N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
41KB

MD5
774788d589bb1fa44977b78be8644349

SHA1
e3f91c78ad4fcad6cc1a0f60a27436601db2e72c

SHA256
8ecf4f1e0dc92f95a42dd9a844e7d629f3a018b3e15521dabe2eae0cb67691dd

SHA512
95d10f20fe7cdd9299b7c018886e4fe04d67b146be9e2c92d185f02fd9957ed375443f57252c76afc48f1afa542de8160f7d1e77f820964456170bb4d5ed345a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
140KB

MD5
5f0864be2759d97447766d6b1502e661

SHA1
1e39d32c7b4104281bb994d7edfd3df9b98b02c0

SHA256
17089a382b55a608d2fdb2f0e5583fe08c761c4a9572c6d99a5bc09e359b48c3

SHA512
831e16861ea19a4a711aa18eecca7e2213c09a347b414d28532c1ca62e72cc944221cb6b60d09d6a767370db9d9bb294bff15a11396cdbbb646d228b4b364bd4

Download Submit