131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
Size

60KB
MD5

9bab05d24cba868f899c3e60dbf5f280
SHA1

ba6f9cd66cf94f3c018643311b80b1c78f7b7b13
SHA256

131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409
SHA512

1cf768d69a7b89adcec7a03e651e047c8bf1c029ee48e48bc09d5bd5e09db2143afdac6b589a6fdff681c074f64eb8fd454ec102900d37b1d13c51f04bd01ed0
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJwRJofJoTHKX/8KX/s:W7ZppApaJofJo7KX/8KX/s

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4626) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe

C:\Users\Admin\AppData\Local\Temp\131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe
"C:\Users\Admin\AppData\Local\Temp\131df134cc321d473dec21b9269e881e768c66459fc369ee3d249d6a9b9c2409N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
60KB

MD5
f98ec340f0b2a9c2095c38b115d12d93

SHA1
6cd47e967bb27d33613ecf9c064f9ff32873feb7

SHA256
5fcd748ed0a3c69f316d19a4a4b4672511adfedd6ebe9e2696bfcdf12b505013

SHA512
f6b5842df947f328f50d515e8ab642fa57d823ca4365a78a657b399cf430253ec32dede1cca7ce84df4f7e6b41a9b6e261ecd7aebfd6347d0ec307ef75eb5a80

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
159KB

MD5
c9bd8daaad30c53a0e3daca4db1639b9

SHA1
6d712503a8859621991125542204603f1d40b59e

SHA256
151f9c878957aaa37d71c41f94bf9e39af590c218d3444e9080cbe9ddd777e55

SHA512
bb230146a75a9cb19637716c337cb887f36a32645b20e36d6bb00d4ca626d72feb91d3b152c8052f3cc57d873403000933d60581f3627f2888f24e856e3920e5

Download Submit