9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
Size

74KB
MD5

d1b172ca53465c1a32aebed1f5d5da2c
SHA1

61c09a3ac275c55a31350c8a8b9fe51b49aaf2e3
SHA256

9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c
SHA512

ddd8d82c90123ac0288a2e067c9efd9cbe095058b1b3a46c45f43d038af2d661165b2305d6faa7c3c2b0ef5d5c009f48c31def3b9d1e9602e2b93231a54b7173
SSDEEP

768:W7BlpNLpARFbhblkYlkuvIYFdm0rEt0rEkEXBwzEXBwAh69YNYoThwRDThwRDa:W7ZNLpApCZuvIYXmdtd9hlyolwXw4

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4870) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe

C:\Users\Admin\AppData\Local\Temp\9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe
"C:\Users\Admin\AppData\Local\Temp\9fd91c4c58f75c37aff5cc492d38f8e8c8bfa19e3b480545288e9adfeb757a6c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3852,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
75KB

MD5
4dedfd69209cf3a15f0ff9154c4e16db

SHA1
3454b6808d11b1a781eec9420fe7a5e24a042aad

SHA256
03c2b93307f627818c9bcfc7c7f8d5e89905b6e7f8aa6ae352c5a0bf98255d65

SHA512
ba1ff3e59054f76526b2b52053b66b503b0f2f2325660ae87788e26bc3a9d12f457fe62dce6671589b27fbf6f139e5e6b026e7765b8983b5d8feac828ebdfe63

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
187KB

MD5
6b339f0f527dc2b4f5f59b6ccc421f43

SHA1
949df1b0fdb628299c4f9c10d66f06b7151480be

SHA256
b6a2abddbd4554a33f4d3d6e75dbe56ad2ee2d22a9c10d01c8d371e335164fe9

SHA512
d2ea38a754114e24ffea3341bcbe581499e2ecb0d90e05201dfd438b2588d504e4919770b4616c1ceff928c17216893295a7e16a715679ab07629b9a8d9951dd

Download Submit