f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
Size

97KB
MD5

49348faf0f5c0b69b0966758ec907a28
SHA1

2be3ad6a69595f42741a228074e03571d781a676
SHA256

f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6
SHA512

2e6fc79b04c0dfabef9374379aec0eafcb08e260e6f063377012dff3096707a5aa03576c6f3397bad9c2c5ae9b2cd4775b6c5c5316650f74bd737a3003f2789c
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBg:PqFF2Ie+eFzf

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5012) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sw.pak.tmp	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe

C:\Users\Admin\AppData\Local\Temp\f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe
"C:\Users\Admin\AppData\Local\Temp\f43ec8e1cd597eced86c0e730e3aa390d224bece3a31e085e764a7a45b2c03f6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp

Filesize
97KB

MD5
6d6a3589323349f4e2f2928274b4ee24

SHA1
095a3e890cdfea3c9039d1b9a557c5a0ec09b7fd

SHA256
bd31ed86075006c937f71b2dfd1106fd03387971aacf74a00df5243ec5e98448

SHA512
d3ed5ab0f6674986abeb3ba6fe88646a3f5997a037019e754d26f2f14a94bb66b21e907ca760a841e1f6d5dacbda3c033d88d6746462913266a11edcb1ec7c52

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
196KB

MD5
5bf51317f99dd351b1877c63b594df13

SHA1
d7dd151dbc6493127e5eb7febc4e8cbc85d5c1d9

SHA256
03d02134e94a491d5f4a3a59d67ea9d5ef1a111d6b25884fe5cdd103a47e2fd7

SHA512
173c5c3e0faedc4c3823be015bf0c23b08c4b187497ca4f67d7db8d8123d5a5632f9bf0153675eeff42920c539713b9e2d5165f7ffd5127aaf69c2ddad2d63f7

Download Submit