d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
Size

90KB
MD5

116ec9d4c789364f72812ad8b64e2ec0
SHA1

e5d50d7e18c71babe10da3fb34bc0b3f6c3941b5
SHA256

d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3
SHA512

96d4b4585bdda2e1224f9f16b1dd748c800983034561cc1833e82338954b9f36b0995c5aeb03eb50953ce8b5ecdb965210fc244304be7d2a09daf670a28249c8
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKggqSXrA:69WpQE0zxgjrA

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4636) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\mr.pak.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe

C:\Users\Admin\AppData\Local\Temp\d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe
"C:\Users\Admin\AppData\Local\Temp\d4eed3f0cd33293c88f64a6bc9f9fdd33c3a429821989699d88290147c9885a3N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
90KB

MD5
4d5016b6093785ba13d5efd14046c237

SHA1
42168f94bd8725010a2ac9625af44f54c605d49e

SHA256
b8c170bfaf12d0ba6f77b56b3c170a0e0214ed7ed2e861dbc2a9e76f736b0880

SHA512
521407469f300eac57ea00e740be1d5af26b1ac6813cba2bca2ac0e0349f10f9d7c2798c997220d73ee8de2e15843b9e6e211a34eeb1f7f341f212637ab87002

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
189KB

MD5
9ca12e4647602ff88025743c21754788

SHA1
57e1826af5418516e7bf8aca0da62c403251505d

SHA256
b1328a7e8e647b9ab6515ea5887fb48efcf934264ad46d67085d11987ed20a0b

SHA512
50044d7852f09779201aa0972acd64537c942a28b733cad52628f27a159b29a54951faf5012c553c3262345be7ae9a2f1de89929fdd9caa2eeb799ab7bb402ac

Download Submit