2cb06b8c00162b4b500839435fc5c18e063411e6a6d8592f3024738efd12f03e

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d025fdc861c3c1f390a533a391a20300N.exe
Size

43KB
MD5

d025fdc861c3c1f390a533a391a20300
SHA1

d9858e7d739f5fc67fbb2e70e869b721709fc2f7
SHA256

2cb06b8c00162b4b500839435fc5c18e063411e6a6d8592f3024738efd12f03e
SHA512

6e01c6465b4b21b2b5a5cd4b6b67a73b3c52f8ef8e60dea75f9036c2f9f6eb2d709978fb760295d241c4810abf0c6a4e88d5f9242bebda4541f504af351fbeca
SSDEEP

384:GBt7Br5xjLvassAgA71FbhvYD/DggNNHpQKMNHpQKMFw0pwBn:W7Blp2sspARFbhVgNNHpQRNHpQRq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4674) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms.tmp	d025fdc861c3c1f390a533a391a20300N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d025fdc861c3c1f390a533a391a20300N.exe

C:\Users\Admin\AppData\Local\Temp\d025fdc861c3c1f390a533a391a20300N.exe
"C:\Users\Admin\AppData\Local\Temp\d025fdc861c3c1f390a533a391a20300N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
43KB

MD5
3c002f38c27fe9526de8f964f4588894

SHA1
c2104eefc8570037c0f66f576f168b30a7c20f4b

SHA256
52308ac2bfe6daee80cf152c073c5bcca19a67657819aabbd33785a41354d216

SHA512
3c7e700f8b0698d5bc24a0b0905faae177ff57ed34acef76f8d1c34b883e38393921f51daaee9b6c75c057dd936702cc9491a5c6af9cd938749c41dcc6d0df6f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
6bf277cfc6669ebf0e64de79f5485d3e

SHA1
dab51c6f4634a36abf5fc044197afe50142a5b5c

SHA256
c4bf54b1e732ffffac171bfb7b28cc6b768fc090e948f3d42d8f4563ff89ce61

SHA512
e0d2b646c047d17ec8ec6a57c4cb614539e09c6e1a1bf8ef27fde1ef2623ca8f031f6d91f290118e4e31ba67002b24a09fba406440b4cd8a6ed8c89257ad27fa

Download Submit