f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fd

Analysis

max time kernel
120s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
Size

42KB
MD5

dafbae086e37b421c3b02e274fbba830
SHA1

5317b03bb4165a4f0373550ee508ee8b8246d4e4
SHA256

f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fd
SHA512

6d4b67861071aee92ea08b7642aeaa21d31a3af51536175e4c58461cf293fe334c6ff9a9c05dd731520af4d3aaf0912d6e85a4b4027a736ee6603c3a989008df
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBN2TQ1nrSLmnw1i/JN68gK1i/JN68ge:W7BlpppARFbhknrSLmwslsX

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4676) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Java\jdk-1.8\release.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe

C:\Users\Admin\AppData\Local\Temp\f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
"C:\Users\Admin\AppData\Local\Temp\f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
42KB

MD5
9c1e31cfd08dd684ec27badcbd35897d

SHA1
1403647ff2647f9994f744e6250c7b4a89ed9ec6

SHA256
b4144b49902166c0124477312450814905e82c4da80e79a0c080bb29634ef4ac

SHA512
fb36da1b5055fde7b6f6da48d6d828a4c3ab1a0ad4e7446f34ff2599fc235552315122e5d0d26464f43f8e2ce7ad71d5701b7c5f25313031180803417ac49f86

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
b9cd493c38296a25667e9a5c3869dbaa

SHA1
479ef43be0e118e88f2f2feb0cc762edf824481e

SHA256
309de84710b4743f8ead1f5e2b9244debfefee5253b0a53bf9cd2ad8a132c98a

SHA512
48b9fb439d0d238ea33107633916ab8affb92af3b2b87de56c621dce89bfd1cf03e1445e851f66039685134ded264886d04364e13fb466cc60c2cc20be4b5701

Download Submit