6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
Size

48KB
MD5

1d0f099245a72d08e03cd8d657b104c0
SHA1

161cd86f19adcb567235ea7535d10f09885da854
SHA256

6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37
SHA512

2f379a453ae8e298e1da93d03dc111ea9660fd04386b8902574715966d3db61aa1c6bb7f916c1291266a8fb8d6379e1b8d4fd7d2a9ec6862b4ece13b788f6b2a
SSDEEP

1536:W7ZppApBULcfpHLcfpXfxRfx6OBuH9uH8:6pWpBwchclf7fHuduc

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4658) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ro.pak.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-BR.pak.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\kn.pak.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe

C:\Users\Admin\AppData\Local\Temp\6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe
"C:\Users\Admin\AppData\Local\Temp\6479f038f76533cffe44a0d3747137ad95cf1bc1a3f2c374f6ba24467ac7ac37N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
48KB

MD5
45a0a4dbce3ad4943f011c253ffee10e

SHA1
4e2b627f81b4278cc105f8df043621a14c043f44

SHA256
0b6faa68ced70033808c112b6f8ad7ce6fb8d24d8af3892766740a9bdec07632

SHA512
2d73ffc8ec84548caa67bb4dac7d21be5bb56607a2f4cbfbea84b579e2a38a28410722af5d2cb885cc2b82a7e0400e3957d3ccbaac5f79dd9480d70adf2806b0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
45a356ee6dc7a06ca3ac4712d22b063c

SHA1
240d0dcb763e6518dd42730427aee00bc78db72f

SHA256
9a4e2bc029a0f634a5f2dc2f41b9af8892fd2428051300bd6e182f0b9f433de0

SHA512
e203c4257466b66bb600358cf766e0bfbd35c0bac3c7e2b785dabaf02347a9672b5c1e77552905b361393f45414dfa3934ced7db483aa29e69e2f339ae5d3332

Download Submit