d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
Size

67KB
MD5

6f86315772ec548258b32220db4ea460
SHA1

69f2330920a8c92065db464afd52b1b8da376508
SHA256

d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6
SHA512

b9467a52cde847fa3ef437c6fdbea021c837cb313fad99e3edf8a959b8ed82d08dcc317c0d0a7f674b91ce5a54e81260b9bbf21e00c8832921e94a487d11a7fd
SSDEEP

1536:W7ZNLpApCZuvIYXxJ75sNpJJ75sNpyPIXxXXS+Sy48Rf:6NLWpCZLYFXxXXS+SIRf

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4657) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Java\jdk-1.8\jmc.txt.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe

C:\Users\Admin\AppData\Local\Temp\d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe
"C:\Users\Admin\AppData\Local\Temp\d88ac5549e5d3eb94e57a60e666adc4ef5ab9f3b8070ca258f763a11822643c6N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
67KB

MD5
771ea79f707584fe9664a8a653e8a5e4

SHA1
329ff68cf9f9f23c9925fce8abcc5299cdd62174

SHA256
2270aa9af328ced90d04d0da5a330087232403f404791f0a5b8593bab5b1b2b0

SHA512
2acbab002089295a0beef3422fe3aa373c70411da0a4f8d393d2946c7a1187bc9e0b58138a376e1e909059c6f5f52d37540b5c6feacbf4c07ebdf72cc716a9b1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
166KB

MD5
da8891412a0cf43e49596ab0d7ed51a8

SHA1
d7316e5e888bc8e2881af70bbdc29afe801e0ca4

SHA256
fe3f203174758f07c028b011ee8939f24391876412a900c448c2c00cecdb724f

SHA512
e721fa2a7219667cfd222afc48eb611c7fe2df04d42ea59ed60bc872b7a33d7483550aec7e8d68a110fadac932c0e84754bfb468bb2970e5bcaa23065034beba

Download Submit