3a21af751d868481a71c209778fb2ca6618d866d6f26605cee09eddfb43825d3

Analysis

max time kernel
119s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2e7fa654fbaec951be78e7011cb0c80N.exe
Size

59KB
MD5

c2e7fa654fbaec951be78e7011cb0c80
SHA1

a56dd3bf653f32b58582abeca6ed26b29e94e0ee
SHA256

3a21af751d868481a71c209778fb2ca6618d866d6f26605cee09eddfb43825d3
SHA512

b62069d9db439210b1cfaa077f72dc378b20873cd5f8fb24bda30962098e2edcdc78e0cf739af2b4194f0caa0613e57d28b5cdfd166a2bd4c24540780f02cc95
SSDEEP

768:W7Blp2sspARFbhJpupZ5pZ4+fTgTvlK1lK6RZR+8/8gClurYClurk:W7Z2sspApkZrZ4+fU7lK1lKT8/86

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4625) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\kn.pak.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms.tmp	c2e7fa654fbaec951be78e7011cb0c80N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2e7fa654fbaec951be78e7011cb0c80N.exe

C:\Users\Admin\AppData\Local\Temp\c2e7fa654fbaec951be78e7011cb0c80N.exe
"C:\Users\Admin\AppData\Local\Temp\c2e7fa654fbaec951be78e7011cb0c80N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
59KB

MD5
5bc3a9ec7483ba5edce58d7fdf318ff7

SHA1
ed7f9c895d14b1256ffc0c3b3a68f7d0c154d507

SHA256
430e5cf1578d29f8b59ae89edf92c6330a25be40c2f8be1e603949ffb6db9e2c

SHA512
d76e4e3c8f569ef03439ae5812805e9e5e1a07bb29e60b0e2935f0b1df082e14c1e0e073e7079009755bbbeaf3fdd5e165cc325afa6997faa12e9da7be66ae98

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
158KB

MD5
a9ff48755de7fb8b2a2741914436b906

SHA1
0eb1500a6b65c875efe7a2b0f6921ec892fd2cb8

SHA256
9323e73577888783d93cccd968e75db25369e7ff25f1ca5a2d9baef27d926076

SHA512
100e9344b8e8bf0e4d85599fa635e28333c1fe3aa9dad33cde0d9115c207c3e7180098f3c8fb33361ddf50a2946bebd9f09b67b3ead12427881e801e983019d2

Download Submit