4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
Size

90KB
MD5

08ef756542d5f23ddc04ece1591afea0
SHA1

7669716dc6b9588c11ff0dd74f393c0b139da452
SHA256

4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587
SHA512

4f9034e1c150084919c5aed085c88f128462ea4a911be58da69aa2671efc6b775174aaaca6e2fe30f298846b6a3fce8767f95b2e29c9453d59ac552c061dc9f3
SSDEEP

1536:W7ZhA7pApH9QHwtRF9ESWu0SWutlggalggyaRjvmujvmRzqzlmJgwmJg/SvqBSd:6e7WpHIyRF9ESWu0SWuDm841q6

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4610) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.ProtectedData.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-TW.pak.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-BR.pak.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe

C:\Users\Admin\AppData\Local\Temp\4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe
"C:\Users\Admin\AppData\Local\Temp\4cfaa731f692903097b8e12abab4da340325215791deb5e84a9e90a2dd0e6587N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
91KB

MD5
763990d6e511aa2e1c90617f315e8486

SHA1
b890aeff4e4f6a4e47eee5c984b29cbd93bcc4b0

SHA256
65a041841de24a53b5c4389c7a84a45f3abb5d63a2e7cda31babaed8cdaf43a3

SHA512
9ea27a5a2d1333a9185714aa040575082263eb2046d6afe73f2a58013249ca376e219fbca4c7c552e1acf0b289f4e3941a5dfc8588f5b770ddbce286f74374b6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
189KB

MD5
0439bb0e5d055b2a39b48b8c6f6bea19

SHA1
4a1e20d2d9f517e45e45b452cf4f8a297cde6fa3

SHA256
096fb99a089562222896aa361e122f73e0d1148f190b9cc4aa58a78a3bbb2758

SHA512
a146eb0337bca209c45dc625d04c874b144787332cfee2b9bc069a03813d2138a683888c055e3356cdc58950ac9a65de4ab07865caf88f45b2fd3846ad9e4a95

Download Submit