bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9

Analysis

max time kernel
97s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
Size

104KB
MD5

72cf96a75eab733d54f8f1ac17fa1c40
SHA1

c1e1a3e34b286ed8b4e030b93a92eb53ed206a57
SHA256

bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9
SHA512

c3cfe0758c303a0ac6e930f22c1464da7255edac5715a96b9cc9f3a5f749716ae1fc0d3f1c3327f75b8a1bf8ec56284793eca758dc6fc34bf8c57395d335d45e
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBq:PqFF2Ie+efsL1UabUadyH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2713) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\optimization_guide_internal.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-PT.pak.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe

C:\Users\Admin\AppData\Local\Temp\bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe
"C:\Users\Admin\AppData\Local\Temp\bd4cac105daf915a8285bde462c893051f79f766355bf994d70185a6b7ad98c9N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp

Filesize
104KB

MD5
b4ea90cdb337c1c8a2e1c5974552ba35

SHA1
7502a28bda5c0245dcce8eac851903937be59258

SHA256
5cde9bf955b6fc2c8e9c8eb4eb731af6dfcc2a3fc75799257ffbc3000e5240bd

SHA512
c7916dc076e26ece5de2f319478dd667443e27cd760c0ec88d2aa2ee7ad55e5544f31dff4dd7e4264ad85751a2b6f5f9c19ea7505e0e52a6a7659be50454064e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
203KB

MD5
63b33fd1998f1d376775e1fd82c60182

SHA1
c7d75a3e283418eac4c7ce7b2e8356903774c03b

SHA256
bb622d515c8de36e7f894fe8fad5c6e8908f8c463d2f479459840ad9a3f35a30

SHA512
87b4205ae0b7ea4a26890af292082b2e280dfa0fbd0bacf7b3b3ff8f9cd25224ccee161b87930998f036b729ccc80fd26307838efa185617d7f1076cfa8966c4

Download Submit