76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320ca

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
Size

112KB
MD5

1dd02b99279b5e9c8a82ff039c139ec0
SHA1

600823e34019871a2dfa68eedea4946b09fd4a72
SHA256

76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320ca
SHA512

3b091f31a8b910c0384bf9e14c06fb25b0bf1f862995fc1149f3bc4f4c54f5cb9227d6c2903b9824e0e0a3fae8459efeb315979f467de841de82fc720829b456
SSDEEP

1536:W7ZhA7pApH9QHwtRF9ESWu0SWutlggalggEpVp+ESIXosbosz1vKX/8KX/6:6e7WpHIyRF9ESWu0SWuDmmSIjX7

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4342) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Crashpad\metadata.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jre-1.8\lib\currency.data.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationCore.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe

C:\Users\Admin\AppData\Local\Temp\76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
"C:\Users\Admin\AppData\Local\Temp\76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4252,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
1⤵
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
112KB

MD5
2fdc6b8d1505998456059dbda352f2c6

SHA1
7493231c8aaf6e2e02a2c3c8c3c08e61c8b6e865

SHA256
060a9928a3fe008ac0200769ea951d77214e26d266479a5cf163eb5529931afe

SHA512
aa53251310f46c875c7e45ff91900d6f239755b505a6c4ed7fa5c7220725bcd03b3ee6b0769899659d562238d3fbcd30f5177597dc886ced1714d2dc5c571e93

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
225KB

MD5
bb3e93e2afa931ba79c684bb366d422b

SHA1
767e7c0c1441254f1cd6f6ab0fc8743842cd8c49

SHA256
3bc58522a56c0d899e7510df634ee634de70df21b790f50ea20bdddebb68c19d

SHA512
ad8cfd48e1729b068736dc9bf39c405668220740d78bf05f0d44f55a2453a07e6b960cb0b698b424ad60e368167a14665c5aff540332420ba222faae06abccfb

Download Submit