4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949d

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
Size

34KB
MD5

b33fa2f4198b8f6166f3f6ab2bb6c960
SHA1

3dc8c108bfcd6fcf8f7dc8ba7ac763ea6107e140
SHA256

4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949d
SHA512

9024c49b418bd2262b799ec8ed135e876ebb2d06430176305e191c4ffe1994cff71aab9e1b58928f1d8933564c547c7c52ce2e3d6626cd2aac46c4902406f8ba
SSDEEP

192:tACUADIY0Br5xjL/nznlAgAQmP1oynLb22vtI0zWXPXVz7jZjLx+:GBt7Br5xjL7lAgA71Fbhvt3avjZjo

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4724) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxcompiler.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe

C:\Users\Admin\AppData\Local\Temp\4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
"C:\Users\Admin\AppData\Local\Temp\4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
34KB

MD5
54e890024cc255708aee32154a07f261

SHA1
d42d0fab5c174170eeecaea0954c68b9a650ab2c

SHA256
5bc523ce5e1a9b2cc9fd59d146798c5652b49e79ae6e34807f47456ed1cbab7a

SHA512
c597c8994ae49697dd783c8513a8ded54161fb2cfc339ad412f8330847de1a27768856191eb00674798de009b397a0b17a90d6106edbcf63408bd15a9b9ee28f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
133KB

MD5
5966bf7da7be0e49641847ae6ce8d49c

SHA1
f939ba8192a3b7379b13a2d1f191740c1dd903b5

SHA256
3154d4401e6cb7f54d8017d1a36761a9c40cc92e5df2f40b192a31738bc9abc5

SHA512
7938f3934a63cafa7e3275a2669d4b173df782e24c7be7197dc53873952fca51a091847bbcedad11e557ffbb2be2036b18be5230ff8b5f4fd01c2070515cf35c

Download Submit