2b982d95eff781b61adcd70022dbaecd915b897a8e9a9ef6a045cb2f8bae4e48

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

081e54f4ab951df5857acdd7eedfed00.exe
Size

53KB
MD5

081e54f4ab951df5857acdd7eedfed00
SHA1

8b4602bb7192f2194410bb0933b53a2c9bbd8c05
SHA256

2b982d95eff781b61adcd70022dbaecd915b897a8e9a9ef6a045cb2f8bae4e48
SHA512

2fad18fb48eca1509a822297f69fc40e72af2fb8f00f5541cca2da8d999a223be707ddadf235df699fcb1fb7f1b8cc33b15a81f6fe1a2fe2effde0582b063921
SSDEEP

768:W7BlprpARFbhJ68nNIreUYEreUYX1nE9P:W7ZrpApJ68nNIreUvreUunq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyLetter.dotx.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\zh-CN.pak.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	081e54f4ab951df5857acdd7eedfed00.exe

C:\Users\Admin\AppData\Local\Temp\081e54f4ab951df5857acdd7eedfed00.exe
"C:\Users\Admin\AppData\Local\Temp\081e54f4ab951df5857acdd7eedfed00.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-113082768-653872390-2867000172-1000\desktop.ini.tmp

Filesize
54KB

MD5
3653060a7f138d181e5b9e5fbec5700b

SHA1
1527a34b7e6499b85edc6e8fd8b1542b8cf6adc5

SHA256
5ea050027bedce19e94449f90ad40d037e24e759d46ceb311bff59e9b30f27c0

SHA512
80276e13e695b36a0cbd410bb02879a5f5fb35f1cd813c21e15e1631012c33ca64969e8ebaa1d9ffd0099c05e0220a4a0dc52c11658fadcd9c09cd27effb1fa9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
153KB

MD5
c530bb1211ddf5e7856a4804ba1eabbe

SHA1
62a60786116331f0e7028b0268586d048d1c7ac3

SHA256
69f29c23420de0830f60368809c006005919412a97ea206eb672afa0e7d48ce9

SHA512
73045cc852ca2c97e6dcf0998a6ab3486924d018cfc3ae794932117626298a19ffda2d0fdf5d8f434b1ad23f968d21a035154e249cfcc948988e5e4d2bcdfdce

Download Submit