648274553880069e1e1b55e57c2b8763ec4d4bb5428be778747af8ae1837c7cb

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 12:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
Size

55KB
MD5

4ada473504405ea42506376eb1477fb0
SHA1

f9ad0dc3658bdb2070fa5e5c482ac7c48402eede
SHA256

648274553880069e1e1b55e57c2b8763ec4d4bb5428be778747af8ae1837c7cb
SHA512

d2ac51f10258ae93e7e7be7d70ee203d8459961cc75939f254108e8a069ccdd2b89822c099e047fe300d850dc88bbd21d65d7d0fc1e303b6cbb3d90f786817c1
SSDEEP

1536:W7ZppApBULcfpHLcfpyD3tHtS+AtS+BKy:6pWpBwchcwD3tuKy

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe

C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_4ada473504405ea42506376eb1477fb0.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
56KB

MD5
fb42c5e9950cb30c262a38c06ca030fe

SHA1
49fe26022a8fdb4fbf899a872810589e4acd6360

SHA256
5068eed13227d303654fff19ddb5be048189b835c137335ec24a646420f4d1e2

SHA512
074e275d079577ba1d70ba678374cc0b3c5ffdb52e4b89e57681573b287fb116ff1ad777d282659b330334dd04d9df7c12945918b22d4c3483c9ddf235ebd43e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
4c08f07e0469f52c2ba1f5606c157668

SHA1
0464f8166eecf89e541b1f79de6c61968c634376

SHA256
f5f66c25a9f0b44e0d47c00aa63f98eb548c584a56e93004ffb6b30d362c1c6f

SHA512
d12c8cf3837605defb311edcbde104e3a6223d612d576c8a5aa57eb9767d8e6db2cb28774f00dca37f8c4092ebe82e610bdaf6a0b54a22b736c70a0d4204e80b

Download Submit