55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514c

Analysis

max time kernel
150s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
Size

47KB
MD5

1ca564ea5b4bad35f6ec2cd26f103150
SHA1

f7276d74a053fd0b8cb72773f3ec1ef321ffe1be
SHA256

55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514c
SHA512

744ffea6b239957e07eb6ad43c5650d39737f5cf9bd3d9ea57328a62318a35827554bec807142f2fa51026193b1df2b227ec86961085e61e1aada9a5b9f79bb2
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1itvtu0Da0DT:W7ZppApBULcfpHLcfpSo3fstvtu0Da0P

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5205) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8FR.LEX.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessLetter.dotx.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriLI.ttf.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL116.XML.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.White.png.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe

C:\Users\Admin\AppData\Local\Temp\55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe
"C:\Users\Admin\AppData\Local\Temp\55ce9000304badb78409e6f0000e009e248efcc53fcf87e6ded7d596b4f2514cN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.tmp

Filesize
47KB

MD5
da99eaec921a99d86f49fd45cb8a8f64

SHA1
4c67d7a05bcca24305418a32085375982817dd10

SHA256
5eb40cfc533ec911a143ba1e7f9cda00df8231e27059e1f069a1f356862ac3a6

SHA512
c1fc78b54335262419646e323598ab78c3d85e35495ede5021ab9f64ff6fde1a0e68de59a6c8064439d2277088cbc6fb08d8bb006197b9d1baba2c2aeca099e6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
146KB

MD5
d49f1dcb4df5d1a4f18030daa8e8823e

SHA1
6d3fbcee4a2dcee59cfc441250d17e65e46eded9

SHA256
24dc1b814f77ebea95e7d19b6c70d0368a144b668e5fd34b57db1c0c95e4bdb2

SHA512
acd66a125b4dd9bb5ba9aeca3d801a15556bf023e0b0afff812a55ae047363393380bca9d758cece64a91e524788cd974b41c97fbf692ca4c589cbf25350ea11

Download Submit