4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
Size

80KB
MD5

fb1eaadc22a74e3f4b613103b8d64860
SHA1

f20a61c99358c7ea6cc2f283d2272f22ec938782
SHA256

4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8
SHA512

cc0298efff5b0f367f82e9b452292561b25c01bf27f3437b0854a19c1e5cd8f1adb50315edf62ef139065fffe1def90935d393d26b309eeef8f02f21ef35d9af
SSDEEP

1536:W7Z2sspApkZrZ4+fU7lK1lKT8/8yNCNzdwEbdwEZ:62ssWpcU7lK1lKgkZ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4611) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationTypes.resources.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe

C:\Users\Admin\AppData\Local\Temp\4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe
"C:\Users\Admin\AppData\Local\Temp\4390850f2de81afffdd1e0d84e5086b6842d2b94373733e63b60bfae138b51e8N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
80KB

MD5
0da5c0b6220af8a704581837097a11e4

SHA1
1e03b692c154413428e4c3e52e24042d54a8eb89

SHA256
2649a040643c8079d6395873330ca916264773d8b8c4d809852a73541b81fbd8

SHA512
112fcf1246a525ba4d952cca6f77f5b2ac33fe29cc87359b6eeba30fed2586a921fb97dcd18fa82c9decede8f22f0b05f828a83991b38f75c5921b5928e5f6a9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
2d9b3682f12cf7ad7666a802d47d1fd4

SHA1
3b330757e8c720722656d01feecaea1b1fcc7277

SHA256
165b43aca024e639e7a4b93a22e71d1bb831041d67388a38eef9d17096920497

SHA512
3c564661dbd0fb13d60ea31e2f25ad0939c8b8f823455817319b633123dbb5d2d88fa1e3e4522853ead84ef6daeb96b38a467070c351d2949cd4a4663d517d20

Download Submit