6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64f

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
Size

40KB
MD5

cbaa84be8862e7947735eb57967c7580
SHA1

3cdcbc58b46f15a28e31f43e89a31723e470fdff
SHA256

6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64f
SHA512

c499b1309dc2f5209914469018bcc2599788537ce3a918db34af65e57cf140854c2b2014812c4636bada83075922f92a8cea95f0790b2c080560c82379e95a73
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSF:W7ZhA7pApM21LOA1LOl6vSF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4676) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe

C:\Users\Admin\AppData\Local\Temp\6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe
"C:\Users\Admin\AppData\Local\Temp\6005d3d119af146a73498c20ddab65a168a164b047d3b2b4c3ba924370d9a64fN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
40KB

MD5
ff44c6836ada54cca4dd46ebe34a181d

SHA1
34c7240bfeb1a8dafb21191556969de1b9e7b023

SHA256
cffea7f0b89ff4a1a32a1f35b73cd7ce48d91ba1aeadcde290dbaef2bdbd7bda

SHA512
2f4f39c1a534869631fefc34e0dc399456756e87e6b1969f2332ddeb78e9e7e8da4cb036f49946b70ba9fe46a541bffe2bd0c53c86ecbacbc60438bcec425225

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
139KB

MD5
fc1be2bf22878dc54b07fb38b41dc14b

SHA1
3f787cc9e79bca0b88dc16ef5bfc7a59a0a9abb4

SHA256
bfc80afab1e01262e643a7f25584037a7fde0ee3cc36d7bafda02f3a82db92c3

SHA512
978dc57f9d6a44bafa78ccc4ed070ca08329b0a72bb7b9f8554070f9c76610b37f8e5fcd16123459dcebe486dae84dbe53170a58ec8974b307fe0e1f128d0ef4

Download Submit