d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76a

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
Size

90KB
MD5

4c958ef99431ee1bd418bc2de3ec2a00
SHA1

a2d5bd79620413669da7fecb88ace31807f45edc
SHA256

d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76a
SHA512

b4e2134125ced671a66268eecea80a832c656c9e8b3071d97382abc2347916e4f2ba619256e3cce88ec76eb768499d5bcab8039b6b82fe82b07f2dd235554fce
SSDEEP

1536:W7ZDpApYbWjIoPyPoLzV7c6ShWfxRfxSUk:6DWpLf7fS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4385) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\PowerPivotExcelClientAddIn.rll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\net.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe

C:\Users\Admin\AppData\Local\Temp\d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe
"C:\Users\Admin\AppData\Local\Temp\d87b93c31d983663aea642d29b1b648f848543e7c6f12f613699b0855a3bd76aN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.tmp

Filesize
90KB

MD5
e25c7f12f0478f374f938448c66f3901

SHA1
d6d0de863b5d97262722c618ee98b15ed3cfd650

SHA256
ff4839ebf3ef653c4a11ec7cfcd95363649c05410972edb4c3581bd5518825d6

SHA512
8e685d60270e030bddd1fabfb9464f5c9c8c3ae15de64b8246e81fe53eb018150b964e1563da1cbe5751bcc2e66a0790e3dda21b7a07c2190aecd1994825f092

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
189KB

MD5
6608aaa8b1e7c718e25f9377a42f9664

SHA1
e6e4e34b962800634d534b95a9cfe6de9c6188ed

SHA256
89bc9822bd00f2d0739017ab537acf5481e1865af39d736c863d09d43c1c33f4

SHA512
352c027edd36ad3f65164e02c3c8f9fd1d91757ab798b0bcc43b118ec16e649b83222865dcf5547117ad40b684e763ced77c7c4545b6d4b85d011bc12dc8e549

Download Submit