32c2629d163a2f0137871a933b40400da3c458511e651986810eede874ff0b5e

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96ad9339dae0f22cd81d475d7de785d0N.exe
Size

41KB
MD5

96ad9339dae0f22cd81d475d7de785d0
SHA1

521e29705d411dfd1fa1baf3576393f96eeb33f1
SHA256

32c2629d163a2f0137871a933b40400da3c458511e651986810eede874ff0b5e
SHA512

e4b82d0a27683111a463899b7d14afec1f90dba164a20bd43f8cec7509201188023767709b0589c488fc1ce29ace252cecaceaba842b993dbaaeda675a1b7f85
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLmZQZX8:W7ZppApBULcfpHLcfpyDA8

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sw.pak.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-GB.pak.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	96ad9339dae0f22cd81d475d7de785d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96ad9339dae0f22cd81d475d7de785d0N.exe

C:\Users\Admin\AppData\Local\Temp\96ad9339dae0f22cd81d475d7de785d0N.exe
"C:\Users\Admin\AppData\Local\Temp\96ad9339dae0f22cd81d475d7de785d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
41KB

MD5
74cf83e2ce278fb4888e28adc9f5a29b

SHA1
4eb234c9844ff951c26c0ff1aac9ad991dee93e8

SHA256
b5e2770a16ee12ab35ee73e53aa2867faa370cd2aed9c0e626f94d58eb052b70

SHA512
6351ffec425202ff1c6d94b7c732282ace952b28ff7776a871cf0a17afdfef621f11a5fc4a4c3c5ed90df2de5a40b3cddbe24d75410cc7a0d4797c7c65b794d7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
140KB

MD5
cb16147c4cba17ba2f85660bbe1f428d

SHA1
46fc14863f58e2e2e258f59e2c05ec7c6993eed3

SHA256
9be26d6081d63491afac4d9d0719d27d634ef8ac80d4c567bac0fb6204bfc2ed

SHA512
7e71cb29b89aec73eb41b35b9b76c1ed562d2de972484758fbd375e58da640c93ff7429f944cbf3d5a06301471823fdfc23dc7866d490505f160af6a6980664d

Download Submit