fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
Size

83KB
MD5

afced3ad833ce9023481133005f034c9
SHA1

c49fe0697b97f8689842bfc1a06baf099e90495f
SHA256

fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a
SHA512

4cdad8e093ca407e01b46b23296949db859dac200476272bc422c91a3a41d954ac44dabca5b3562771b2a36d6d8778b85dc53891131a31bd51651dcf9a71ea6e
SSDEEP

768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORReY:W7ZDpApYbWj2WTWJe+e/qXhgA2E

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4865) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-CN.pak.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe

C:\Users\Admin\AppData\Local\Temp\fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe
"C:\Users\Admin\AppData\Local\Temp\fc84d52bf2373ee501e389c76225f6779cda05fbaa4fcb20f95c6d90a736d83a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
84KB

MD5
252b4dfbcc16358c7453f31b545b9719

SHA1
26d0a9b023ea413a103d05c2bb49f8892d817290

SHA256
7e8acd5eecc23817cd4c466a81a6ca28b18576ffa9c0e8b8d560a8f59c440a41

SHA512
94a6d68c2a2acedc39f7f439d6590983d6734459eff2551574f960d3b951605f2d992274e35c6e415526e6457bfeb8c90ac6307c831a64f0311b0bdb93107fb0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
182KB

MD5
41c43b4f544109490715d687915b6d47

SHA1
d565e232bbcab045fc4717ae87b4ba00960dda4a

SHA256
62fffd1345207b6fbf523e90ccf4826f00dbc5da62acdcadd2d50b74651ad0dd

SHA512
d2025d68162abb433b77183649a7b01a775f4fe9be69adc44844408b24c3214293f92492503dca4e3ebddf5607ea27ff78396694df3d099548324186851bf918

Download Submit