cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809dd

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
Size

87KB
MD5

09e7528d6f8898efd2db84fb8ea215a0
SHA1

cdda47e813f5ffe3e23321717b6b0fa6fbed9efa
SHA256

cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809dd
SHA512

055ed367c6567500054f2dd6997314f08de554e892b734b9369fa0f4da6f7d05eced15a89bd1507da8ae1196ffab0f1d8aa4250b0048d30aa32adbe1b06c89a0
SSDEEP

768:W7BlphA7pARFbhM0KW2s9B4b09Xgd7jylZqzpEPZD:W7ZhA7pApMaxB4b0CY

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4610) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe

C:\Users\Admin\AppData\Local\Temp\cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
"C:\Users\Admin\AppData\Local\Temp\cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

Filesize
88KB

MD5
0e032a63a93346da4a44e476e8126314

SHA1
1c3dd9a18e1dc2340252b392715a7edb6e1aba76

SHA256
deb0c5e0752872f7b14e13a8540263f7ed52590da935c68375f86ee8a25d73d3

SHA512
0bfb63cf5a42d074c12e6901d9ccb689b0c666884767d2ac460ea8d1b19666e7a13fe847d546ab8cb565e6ec026369c9a2e51d07d2da1b4eaaa532d123db0986

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
186KB

MD5
354e442cef48aec08c6b0344c96ef5af

SHA1
04ff227214bbba48ab62b1304b71d06d9d037fca

SHA256
196b2b38c2425c1254cfb3ea964a5e54493d8bd952ed5e3a3ac1b36b817e4ba2

SHA512
74223cfc69a2b812a2a427d7520f22898b78eeb77313c79de889b65f2ad64cf15de00f0c663149cae8d82f37e623b26f221c5b04b6cf2871d1b516c97d3b6899

Download Submit