ac0ff3f5d0188af2a7fc6bc0ac2124b67d0ce01db9e31c6964ce54856a513344

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdc99c56b3a6e86aa6be1287205c1a00N.exe
Size

70KB
MD5

cdc99c56b3a6e86aa6be1287205c1a00
SHA1

91687856f8ee021971121a2c4692c199037db96d
SHA256

ac0ff3f5d0188af2a7fc6bc0ac2124b67d0ce01db9e31c6964ce54856a513344
SHA512

c1ab0ef13487cc746e96df0e14e9b41242089cbf9a343cbd0c347d37673388fda6069e06e04377fff439dcac6044710339dac991da8bc25fbc6df839836e3abc
SSDEEP

768:W7Blp2sspARFbhJpupZ5pZ4+fTgTvlK1lK6RZR+8/8gClurYClurUpOpDd:W7Z2sspApkZrZ4+fU7lK1lKT8/8Z

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4616) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk-1.8\jmc.txt.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader_icd.json.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdc99c56b3a6e86aa6be1287205c1a00N.exe

C:\Users\Admin\AppData\Local\Temp\cdc99c56b3a6e86aa6be1287205c1a00N.exe
"C:\Users\Admin\AppData\Local\Temp\cdc99c56b3a6e86aa6be1287205c1a00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
70KB

MD5
0dcbad4079b65580225388c591f40058

SHA1
2b5f15f780fc2438b40a212ae1a35234647cc593

SHA256
298a9ca143cf6c7b9dac7d5edc090e1dcb82837c76f3e814e8a4087bf0910f46

SHA512
1a982326fad74e14d2f1b69059d1dc140951de735c178541e949bea64feed9813116d43c423b30dbebbabbb21a8520b8fbd6f33885f1b294472d7b792a840c7f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
169KB

MD5
19558946e3bc73ef23c3f47a90731035

SHA1
f9b4073053014ca158dbf94ae4b3ad4adc654dfc

SHA256
3450682dec7fe8f9b20fb984f27d6961baad56b498d39398595e9d433ae1d007

SHA512
5206b47127bfeda1ecfd40f87f82cec5a3a85ebeb87d00c784759eb094019b29adfc909a4ebc1d98de1c242a7eaa162753b8f876e54feb6409a6420d3b5b20bf

Download Submit