728c5cdb2f7fe50a9ac19d98f7562f8e8e98218ca4d66422d39f6c434afcf709

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90f4d12f95c8f635ab1079712502f160N.exe
Size

80KB
MD5

90f4d12f95c8f635ab1079712502f160
SHA1

119792998bbd6636855b9e57021ddf7779f04130
SHA256

728c5cdb2f7fe50a9ac19d98f7562f8e8e98218ca4d66422d39f6c434afcf709
SHA512

696028ff3e3681934c0afeb900816d301fd4a691bcd5b025b78c41c0a629446842d3927a225110f15f40041244b1a57a90de197036777599516eed107837cebd
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7YNNdNpyI8yIRpC4Cm:6e7WpMaxeb0CYJ97lEYNR7kzlSnC4Cm

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4650) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Primitives.resources.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ru.pak.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90f4d12f95c8f635ab1079712502f160N.exe

C:\Users\Admin\AppData\Local\Temp\90f4d12f95c8f635ab1079712502f160N.exe
"C:\Users\Admin\AppData\Local\Temp\90f4d12f95c8f635ab1079712502f160N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
80KB

MD5
c4eaff617df629ff9b5d024b079265bd

SHA1
707ff64dd6ac6bc6d0fa219b83213b9c055ed104

SHA256
3d8f67c9bf56118bb6333a75ac533ea5443f5078d71e080fdeef0ff58c497b81

SHA512
a2610951d94bbe975c139b9007e00d023939c6c15e5430b5ca961b6638f29220248efd2564ba9b6d1376f6582cc9cb08546563521931bfe1addb180fe4021731

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
509ceb293e19fbf07c2c62a696695147

SHA1
2b4da72204200c52f375d157296bdeaca60f6b6e

SHA256
62d38a34ad409fe278d198b75ee39528164f411c86de743bcdf90f200994cf53

SHA512
b9d364d54f2388717ada61be6a27bb95fe2a9523a6706fc75ae2e06bf1eecc9dce1e1bbaf53c60ff1241e9af76f79810ac9c9852105dfc78ddc2f36ef18527b2

Download Submit