dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
Size

47KB
MD5

bd39e43b93b028f3c076f6ff99c0acd0
SHA1

858773d73e19484f7a1e061dfb5a53b992772067
SHA256

dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879
SHA512

0c566752a7714c23e69a35c20a5dc653163174a66b36977c3dfdc94e54c0de3ddff16b3955809eda826ca8d4ed41b456b2e16cc88c9d67e6306046fb09093eaa
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c5qrVfZfIVUA8VUAK:W7ZhA7pApM21LOA1LOrtkpt6UrTATAK

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4679) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sk.pak.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe

C:\Users\Admin\AppData\Local\Temp\dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe
"C:\Users\Admin\AppData\Local\Temp\dd55d922878c52d43b625d9808d71e496a2ebc4301578d31e76772fa40206879N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
47KB

MD5
015774cfd7d4cb53971927f76f08a620

SHA1
1414c77d2425034914b2e9ea20c20d05a77e1507

SHA256
1ffdbb2e4ff03e7620f7f5bfc131043ec099be2964b284b7c7c55dc6a882bb98

SHA512
9dec84f5b389f5a5e17c31fc513d134aaaf1084761d91119dcae38ae82a3108abb469333913c26cd640aa5b05d8b73a0e8f111956d8802ebee0f52b280d1227c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
146KB

MD5
efef11194779533c16f67d49a6b98d4c

SHA1
a273490f33510405ae7f7a97c57e5f1437e519e7

SHA256
82112480168f47ed9c4ff43280017da0262d4b9b8c25e0dc0145b95a62d4cd6a

SHA512
f61f4df0d7f074579a5dce72415b5ac2c7a270aba57d66329c4075aa8c61475fb02e72f5d6f74ea741b5ffd6b6f47da1ba8dfc0fce225ce86f0414ebf1291256

Download Submit