06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
Size

32KB
MD5

e7f1b05e8b0e7a834946a10640d582e0
SHA1

4eae5a5bd9ee18a427927b52d65f737d3b084ae3
SHA256

06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117
SHA512

68cd803bbf5c0b5cb1730306244f4637225df31bf8bdc29dcc5b81e325d7fa88d5a51c8938c5eb755706edea92b26feb7240c05967394a6611773fafe777fa40
SSDEEP

192:tACUADIY0Br5xjL/ScAgAQmP1oynLb22vtPeGyvyq1iGyvyqkErB7rBYRvLdvLWE:GBt7Br5xjLfAgA71FbhvtPcIxk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4631) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe

C:\Users\Admin\AppData\Local\Temp\06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
"C:\Users\Admin\AppData\Local\Temp\06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
33KB

MD5
faf79fedadf8a009743d7e310bf21925

SHA1
c155b80566633500c0f5f4071cdf5ec6060a4d22

SHA256
53203bc4c971c410e9d99f350437822c6f89cdc994eb04346f1ad219a254086d

SHA512
87d93eb72760e1f3345c06425353a366f9eea2d5356020043be16684b96c5004c54bd3027e0dac875a9a33c0759b6852bd76f33e46bf0eb776b457224a23e335

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
131KB

MD5
fdf43dfce9156c587ae6a235e9ad6f22

SHA1
a1e0b5933f75883678b2cf9827ed450d66af9cec

SHA256
d11369764bebd71ad3be9bde3b2bdb1c0cadce97d9ecc263be1a9fca6f076a06

SHA512
9e79574a1c1c1ffbb644dab26ad271d222b5b8f4e376ae422c842ee813fd0682007723e856b47a06038765120cf21badababd8b09564d7d133dcc1bf7ff3db0b

Download Submit