f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58c

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
Size

43KB
MD5

4fa86b726a857b6eeb0bc31c815dc990
SHA1

5a7da7286be496bf8edf04f12665734e0e0e4e41
SHA256

f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58c
SHA512

596c993321716750c76ddbd91806e56877ddc19aec6d5a4f5cfc960b649a81aad7c2bd8a32c52d4c7d84a0953f14958817648e6968eb4a49dc911f300fa8af8e
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFcO1dp:W7ZppApBULcfpHLcfpyDPdp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4670) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\tr.pak.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Java\jre-1.8\release.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe

C:\Users\Admin\AppData\Local\Temp\f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe
"C:\Users\Admin\AppData\Local\Temp\f6b1f8ead8ff7428a04b36548e79c43bf232d62c48d1cb5f1b998925cb9ce58cN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.tmp

Filesize
43KB

MD5
c1ff9964eb82ad0362dff45184240fa8

SHA1
31b66db3853c19c45831201423cec9ddb4e303ba

SHA256
16094ac3eb966d5d1e801cbb1a79827576898de0b68a3c131e1ae5b4e171677e

SHA512
62a7e5175715c5b2f52868cb583cd3f0fdd0326b2405ce0d4c0e5d50d036e61b851fd61a2e684ca70edc4f2b1da8c0947b49b8c6cb5858c654ce20c479951b62

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
f2f3be6c5a91aa948e6102428b16cc70

SHA1
1a4d4e503345bb30c140542cad5146f0c2f1fd6b

SHA256
8dc4ddf18bd21a4bea500fc62bdbafc464b3274032644f52ed1884c11761cfad

SHA512
c74b8da1ef79cb29152d4f674f87be72271322ae02e57f6155da2858981c74372323001b12ca63394a908737fb922cc13f6e22ca6abb67ba23d9712305ad6806

Download Submit