f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
Size

55KB
MD5

cae22884b53214d7645e8c0055d154a0
SHA1

ff3e039e09d47f9fbe395f79f370db2631544c01
SHA256

f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16
SHA512

e8f51c315061db639ffc0f59d6f330c11f856eb1ba5642cd87530431336ec6edb09e60a567171cfe089a7af272247c55b41cd4f7eab919ee41100c35b2ccdee8
SSDEEP

768:/7BlpQpARFbhNIiJwsJwwnZap9QKQZQIQ+:/7ZQpAplJwsJwwnEp9QKQZpx

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4619) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fil.pak.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Java\jdk-1.8\release.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\libGLESv2.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fr.pak.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe

C:\Users\Admin\AppData\Local\Temp\f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe
"C:\Users\Admin\AppData\Local\Temp\f91932f8d4d5f2c882bb0de0284cce9878882551c6b93be4fd4797d4e24e5c16N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
55KB

MD5
195db328077e7c095e63cd441bfe5039

SHA1
e6bb9987f3a5b46135f9052087cacdbb65446f9b

SHA256
fe34eee2340267460c4c49453effa3dc68cbfcbf37ea38b3c98b8dafc7fc6f94

SHA512
a1c354a998a978ff4ff852b5ce0d7b2d800ebfb23d090072f967e868d6e5f7f1e3ad166ebbbb832f7abb3ba40fed8c52324013e585ea285c3b145a5a788edb51

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
154KB

MD5
c928e153f2ceb88507fc0c0c6134abfc

SHA1
f7cee5a26204368411f08a7498bd2ec12ac686b6

SHA256
c14ba676a64cf67a82cc6ad6bab564c0a6bc7c40fb76a4e7c1d9581ee0425fc8

SHA512
947d7e87e10dd1939e1f4a6465be16e06467137c9fcdae05ba3ee8349b846752070989495c7dbb0c496665750548a5b4e8aebae07b191f63b63b27d11cf8c5e2

Download Submit
memory/4276-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4276-874-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download