9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eaf

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
Size

47KB
MD5

9544f6036ae67f2fd5fae3a5bd7c0390
SHA1

90b8d53510b4208504874f8974fd63b5df5d6f70
SHA256

9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eaf
SHA512

7cd7b082edb0efa7a940f5b1feda9925ea4fdaf16c06deb8fec19935089cba0653dd9f5067e40ac01b8d8842be9ceb1487873561fbbc668c1f417c8be2571c0f
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLBbfCDTbfCDU:W7ZppApBULcfpHLcfpyDkbfGTbfGU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4672) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hi.pak.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationFramework.resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe

C:\Users\Admin\AppData\Local\Temp\9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
"C:\Users\Admin\AppData\Local\Temp\9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
48KB

MD5
47135a2e71d8770230d668aeda1e7128

SHA1
e5a5234d8019e8c69b6e5ab1045e71967bf70fc1

SHA256
c4399e15fb68e31085e086357a1a645d00302c139e715e941110dc57fd535616

SHA512
6ccd6cb754d1cbe7ecf612790e44414666201b7b8c7fdf0aba9aadbb00a24d78a22dfeca0a6f1eb1846acb60080603460d77d32177fd7a5db5e803fea98947d6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
146KB

MD5
f27d9490a360f7fdc62706866434496e

SHA1
36060ae5d7a69f6d7c499d0074fef6a4f58f21e5

SHA256
cc5cb0af546257e2c8c069931fbe403b01a2219384a9bf753aa9335f6c4ae01e

SHA512
3e099cd40abb44d18e63b68ad60fc020abf333fac333ad5bfc75c2eb742505a5669bc0d8e8fbf398f51bc808412b3e5fdbd52ebebd74a66885a4a36e71ddfd9d

Download Submit