9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bb

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
Size

109KB
MD5

1b90e32357e4ee996f7bfe5738c2de30
SHA1

a261b2c52b036609eccae9940532889bccb3edbd
SHA256

9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bb
SHA512

957e8c2d34241859c3dbf8db4ebc04ec18f4ea49ee9eb3af1ed868edea63d63f47847afcfc6a583583c99569ecb401231802458a977e0339c6bad327b008a7d9
SSDEEP

1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPIUpCUpiPZ:6DWpwE7oL2e+efZwZ08i8Q

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4346) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe

C:\Users\Admin\AppData\Local\Temp\9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
"C:\Users\Admin\AppData\Local\Temp\9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
109KB

MD5
412a30b70479adc0f99d9a9adde95966

SHA1
ec2bd8891371c8885606ee26747117a2b96e8eb8

SHA256
fd36a47d03e9c31f9d4f4e9b34f0052172a71e53043a49d85a7e9fb3e6e8a520

SHA512
bd18552ea9394cf89aaf0c36538b315dadbb92fcfb9d926c7e27d0c59fdebcb54c58ef5cffe02437fcadb15e235debe4d4ea56046686718e595078a68bb91eda

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
208KB

MD5
8b121ba138ae62d64c57e9a347a75cbc

SHA1
27ffd93ca347e14cc5025b09100cf369727d509d

SHA256
b566d95cee2b54202d8cdf02874aac5d70cf7b4190ea22a489886612199a13dc

SHA512
8c54e4dc677cd34db859a270a1ad33b1b7fbea20b77ba634bad2c43e8125f84e883f1067accf0a9b0b24e05bcaa5a14b4f74d888a641e5d24f7809e9170b82bf

Download Submit