d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
Size

91KB
MD5

e6b71023deba5610474083c104e25121
SHA1

10d561bd955b2d5e29eaacdf5d1891217bb6cff3
SHA256

d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae
SHA512

469e0dff48471d77ef969bb24ed461d176cd413a1bfa6b1c6f8abad9038a0694a7f5a676aff6c83f723da658c2a4062ea2b238d447fa92a91c5b68d5d97d76bb
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKgg+EvBnHHwTVEvBnHHwTEwQ:69WpQE0zxg+TOwQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4866) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEVI.DLL.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.exe.sig.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ssleay32.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-CN.pak.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe

C:\Users\Admin\AppData\Local\Temp\d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
"C:\Users\Admin\AppData\Local\Temp\d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
92KB

MD5
00a21508bc0f7903c8479e02a95ff388

SHA1
5e276a9a17d828ab24e0ca71c156fdd711726c82

SHA256
a51a241742449755160919c63fa52528b8e2266eee7d166a9449042435109fab

SHA512
165fbe34551cc61a0b3005663107430fbc47d88cc358391ee821fe414ce9899bbc034a3320b1407258395e6d49ec17f3db815bf94b60006955291e3b9a8366b3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
190KB

MD5
84253da2e5e64657f528838d08b41c9a

SHA1
d51d7fd3ed39b1aa645fba37436a40165b941093

SHA256
9b67f8e3d956b3f29933634ef39c28d77befef2d5124a26f119fe8eba62f69fe

SHA512
08c07084be63bf4f0decf1702bf9c6c0aa04914d65594e5ac3345fb5f2a9763ee57d76c80c69b97c5cb108ad822d87d2107bed8ef2dfa7e6a148ae73d7337c87

Download Submit