fbb1f860c7b0ad5b7228875390c09aa580587eea76c05fba2fe7c0bb11c36041

Analysis

max time kernel
119s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ea6525ec120d2492e81131c71fbf9a0N.exe
Size

38KB
MD5

5ea6525ec120d2492e81131c71fbf9a0
SHA1

713bd07ecf6ae51a5de33d05f2809e73a9a10a61
SHA256

fbb1f860c7b0ad5b7228875390c09aa580587eea76c05fba2fe7c0bb11c36041
SHA512

7a38c3017c4f57a00746b36abc001c2d46cba9457c387dd3be109351d287dd0511807142a83765747514d2b5298e6eb36e0162cc015dc3e6da20877fb523c055
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FXtqAYa9tqAYaq:/7BlpQpARFbhTYajYaq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4373) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.MemoryMappedFiles.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\csi.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ul-oob.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\WidevineCdm\manifest.json.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ea6525ec120d2492e81131c71fbf9a0N.exe

C:\Users\Admin\AppData\Local\Temp\5ea6525ec120d2492e81131c71fbf9a0N.exe
"C:\Users\Admin\AppData\Local\Temp\5ea6525ec120d2492e81131c71fbf9a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini.tmp

Filesize
39KB

MD5
b0d68dada3ac543a02b5f6e6501f6ecb

SHA1
56d2afc883b21dbdd4f575ade9e854f5a9fb473a

SHA256
06d5e8ce48d0001a665b6de242a5a158ab81073929b4c7fbe077642f94c3a27e

SHA512
f452291dd313aa8fa9a48f289df8ba97cb6487ef897d3ff070f4fbb229f8285df45ca31fb510332843c68d6237a19b4495c72f39ce66b7d0a41cf4338b63bf41

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
138KB

MD5
40c95bbf568a1a75b4e852af0f4386b1

SHA1
4a6d42e2d441ae819922c32a3dfa3c5d14819e61

SHA256
684cdfc5da4f3728073134460b9e4f8525e85a6a9639049e40e7d098cf473f14

SHA512
41c2de1359790dad0bb9edc1946ec3cc065ceca6d0b9488f3c0fe500882887fc297a280cdb3cfc98a0769ac30254fc454493b6f6112b7d2cf451762a3ad69720

Download Submit
memory/4704-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4704-1792-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download