3bc2e78887502ff88ff083e160debfbe2f6935c9cb3a000088d815f75c807c24

Analysis

max time kernel
120s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06dcc7876979185fdea540dd95093d00N.exe
Size

46KB
MD5

06dcc7876979185fdea540dd95093d00
SHA1

5c77b789f6d1a36382f5bf37c552fc1c0f01df5b
SHA256

3bc2e78887502ff88ff083e160debfbe2f6935c9cb3a000088d815f75c807c24
SHA512

7bcb406f10c9ba2943a0dd7cd625aeb951eba30e80f136154b9ae6eb8bb73686fc311114e1dd224e307e50ca65fb4992a58a1034f1eb33dcba83d425db4330f6
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LObC8p8bvM:W7ZhA7pApM21LOA1LOX

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4663) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationCore.resources.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	06dcc7876979185fdea540dd95093d00N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp	06dcc7876979185fdea540dd95093d00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06dcc7876979185fdea540dd95093d00N.exe

C:\Users\Admin\AppData\Local\Temp\06dcc7876979185fdea540dd95093d00N.exe
"C:\Users\Admin\AppData\Local\Temp\06dcc7876979185fdea540dd95093d00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
46KB

MD5
74bbd709f837ce1c85482c7e23ac5b15

SHA1
24ba8d0472a42ee888320d347bf8512d1a9787aa

SHA256
164549ea782be755ee6ae918f86863f7afbe11d200331a849675d966b4e60ccd

SHA512
92dc84be3e1b76ef64256c91ced1c47eaebdcfbaf6425298a8216541e7c9d6cd370d043c94eccdf7f007c2afbea4b4712648643a128045bbef31d218ace18b99

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
41ec6833c98646ce53bf65c7f9907779

SHA1
4d66f74c9740b7493f8dd15168a05c356cdd6ece

SHA256
85008dd706ec2c702646f5dcc53cce61be352f1f811b722f0e465d1c1d5af32c

SHA512
4b462c68255ca189967589590a0058424fbc348efcd37cb07ff64ca7527efcc27ffeea57ce0daa03590df9b0c920fabb453d4b67540f6cd14bf0b2078dcbcff0

Download Submit