84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241e

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
Size

49KB
MD5

beb72fb95026db798b76957162dd70e0
SHA1

43d8ad426d45c5ff2e9fb37441bf8bb49f2991e0
SHA256

84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241e
SHA512

e844ab77de5a8d89f7562efca6f069f01604f6ca2aafeebc32773b6ead65d8c87d864a6384c2f4cb37b6e82f6525af5330bc86f654e80c655aa499bb8116dfc7
SSDEEP

768:W7BlphA7dASbSjJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c5G:W7ZhA7dABJJZENTBWv36s

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4619) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\InvokeRegister.ADT.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe

C:\Users\Admin\AppData\Local\Temp\84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe
"C:\Users\Admin\AppData\Local\Temp\84293dbb7f0f61ddb63ff5bc6850bbb1715892036924bb2efa72a4c63090241eN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
49KB

MD5
e37329a14cab6728904a304942d91436

SHA1
d34d64739442b407b84f11e864dc6aad89da3c0d

SHA256
cca3fd1bb2fed481fd5f07a5e6dc6c93cdcb53e314445c850915db1e19f12fb5

SHA512
9e4b42a25c5e8d9b5710b7727ebfcacaa915f19610e66e8022452317fa392a4a5140aaeb6e4638fae6aa9a1980986f15f0657aa16b4d2e00815a32048b969d46

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
148KB

MD5
d5b2493d722ef96c505038cbe56ab134

SHA1
5038f162d42c2e973c233860a16e75d880c6fbd2

SHA256
b5bd8e421ced947c9f2af1f69df6ac33feb5922d26937ccf39fab11fbb20e8a6

SHA512
eeb6a671c7571bd8a88fe21ce11cbb70612458c5b0cf3a70a91ea3e25b893870cf93b3e6022dce739e0d19b0a918c7bced284a0db63b577d35e6379489de0283

Download Submit