4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
Size

43KB
MD5

b326895e923c9bfc099e99ad2ee87230
SHA1

fcc4aa12b9b4ef9827a47853172c407ac0204234
SHA256

4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602
SHA512

5da25a77b74d5dabfd6a2b6d0c27b8e45ec43eb69702559b104138be0f70e8ba8fb45903fccaa414a5c5ecd0a9005fb35fb53780f3012154cb2adffbc6b62744
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0IIqd:/7BlpQpARFbhNIiJwsJwwnZn

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4657) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe

C:\Users\Admin\AppData\Local\Temp\4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe
"C:\Users\Admin\AppData\Local\Temp\4085c350168fd844880ade0fb4706835747376542d8c5f20d160e19508209602N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
43KB

MD5
94a657a0caaf3d5f28dac600e884b7a6

SHA1
67b00ce069b43e4cc54e0ad8e4fe410473c3a4f3

SHA256
0aeb3f87be73a58c2e39e63d477466a3736b2c962f6b5585d55e3db0ea412a8a

SHA512
482cd17ec094b2d246dc893ea141068081077f61750d8bf398f46dbf908ca2ca9dd54463e92c27e1bd3e83d3dc201a0f07bdbb6f5225a783f50e44e0dab5d22c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
f65022008dae0abff05af48978a10f07

SHA1
adaea0202a912a2ebfc7bf5c9e143836ddfbd04e

SHA256
310a7a8956bdc6a21f47d6b50869e08600c8a0ac1ffee7c6ba024d297a1661e6

SHA512
86def21ff252bd1e135d94812904034c01f8d615830107beac410cf52d59ed0597d2249f57a18ac50c358abff4f2ef034632dc78dabdc865a685f38241663991

Download Submit
memory/4108-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4108-864-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download