7ff9d96c7f0f69d9d0d7e960ed9235680486394fe96e4ee9a60b8ca0296da82d

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d2e40890e9c7d54b5024a3001c1a310N.exe
Size

89KB
MD5

0d2e40890e9c7d54b5024a3001c1a310
SHA1

ee64f55981b91a20d3dc15fb4da93bb658fea182
SHA256

7ff9d96c7f0f69d9d0d7e960ed9235680486394fe96e4ee9a60b8ca0296da82d
SHA512

79e45cd5a57caa6566930c4594a19b427e7554b95237e991cceaa8790ed6d2e991f1c5755ffe7bde07df96f004dd37da7044432ca1075f7cefb9bf2f2cedbceb
SSDEEP

1536:W7ZDpApYbWj2WTWJe+e/qXhgPHuQYXr7HuQYXrj:6DWpaWTWJe+eQgP/YXr7/YXrj

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4362) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	0d2e40890e9c7d54b5024a3001c1a310N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d2e40890e9c7d54b5024a3001c1a310N.exe

C:\Users\Admin\AppData\Local\Temp\0d2e40890e9c7d54b5024a3001c1a310N.exe
"C:\Users\Admin\AppData\Local\Temp\0d2e40890e9c7d54b5024a3001c1a310N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
89KB

MD5
9acb0e83dfb0d7550f4b60e4cd64b69d

SHA1
859ee4f34a9fef9adc4d931206f20896397e110a

SHA256
7d5c58bf23a1868239178958d0b4cadee07ca51f20ee3506b4aa10a62206b27c

SHA512
a2d10e26811caf8ef5932b73cd49f0ee904c812175255b138d8c533bf3a75fe17eae19659144587378458eacc9f28df0c72206655600a5a305b8eb61a3591bb8

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
188KB

MD5
a420c9ec9217dcca110562c826d03a9a

SHA1
11159188802c5037c1dc5383c1d74499197ddfcc

SHA256
9536f8c9b651b503e599ec0e8307702252b570121d22713e15cf4d0efbeb2339

SHA512
48e9435b191c9cd482385d9cd739122481ff74b09f2a5e40c40a2af3c7345693afaf7a4acc3f5a166c3cd25df64e00f7d1b2de1ef303737641ee0a4d530d6d85

Download Submit