cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
Size

32KB
MD5

5af89947b8a27a3a7bab1f242ecc39d0
SHA1

fb46b3db412a104c67ff0b1bbbfe1edec31366a0
SHA256

cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08
SHA512

5010524893d037afacdef7de0cc2a48b2f48fa430d4ecf5d16c38f051a664465c73f4efa1af99a3c32e384172a5a4a690abde4388cabb9bc2837175c8677822b
SSDEEP

192:tACUADIY0Br5xjL/nznlAgAQmP1oynLb22vtI0zWXPXVzB:GBt7Br5xjL7lAgA71Fbhvt3al

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4670) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\mr.pak.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe

C:\Users\Admin\AppData\Local\Temp\cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe
"C:\Users\Admin\AppData\Local\Temp\cdf522b4a78700c2dd37635f0b6a42b5408ff4d8e4041bcda043f3161aa73f08N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
33KB

MD5
a8279c0e0bfa0c518efa2e8e00eba7ad

SHA1
00dedcabf1c3d35b633f262e70c25b143b5b5341

SHA256
4d60d60537d6873837864fa686b83271d131cc8e5004831af87df225b0e01244

SHA512
26ffa4fc10a284db364a85585204648d32b8737f1b33ddfb51778f21f7804b3ded2aa82abf828e1ffb463f0f843ebd90da7d20204cb0ed39d80c4a6fd793b1ff

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
131KB

MD5
ed8c49bb078256c63ad63570081c8748

SHA1
2d373a729dd612dbac7c4a6a342762e833d073e8

SHA256
5c3e6da5ebc189cff938cf09b8caa7690a1b5c496c14fad21d9aa064c5b73f2c

SHA512
fca873971232f9392982c8834f3d793da6cf19023967676c009cf0aaef876303c0319526d6fbe53215181c1b8a622cb582a3c7f8831097dc58cf6725e114ae72

Download Submit