e4db4b6b105167286b0d730383c8052e4553560b47dc055ea96caadeb5035b97

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7819b92b1514e76a98a35f05fbe4b310N.exe
Size

62KB
MD5

7819b92b1514e76a98a35f05fbe4b310
SHA1

0779e87f1eb5f90efbb5ef57e379ae0dbd340867
SHA256

e4db4b6b105167286b0d730383c8052e4553560b47dc055ea96caadeb5035b97
SHA512

e6b032167f2e49bd78015b46f7d8336677d759c39f7dd192aee1a7a33f25d946690be99655548ce0208964b5e91dc51555859873ef525017cea19490e09b28f7
SSDEEP

1536:W7ZNLpApCZuvIYXxJ75sNpJJ75sNpyPIXxXXS+SrTV:6NLWpCZLYFXxXXS+Sd

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4626) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\InvokeConnect.xhtml.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	7819b92b1514e76a98a35f05fbe4b310N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7819b92b1514e76a98a35f05fbe4b310N.exe

C:\Users\Admin\AppData\Local\Temp\7819b92b1514e76a98a35f05fbe4b310N.exe
"C:\Users\Admin\AppData\Local\Temp\7819b92b1514e76a98a35f05fbe4b310N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
62KB

MD5
3f26e8a60d7c0828d4ad2ec3f9c84ff4

SHA1
f6326c803f78fc49ad1dd43d73a250683ed8852c

SHA256
0878f7a30de3ffab45ce3405c9f7c527935fba348af0a4eff412d665ba4cf250

SHA512
4b3d2eb55dc932f09b0b5281c53ec2968be38701eaf66bc39da67d034629e2849d3e8a1e208d009778f77ccf2697d57506763349032cc1c0d9c2db481feadfc3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
161KB

MD5
c96403e30cd83a4fd2738f84ecad243d

SHA1
ff23d46955f94a6758dd08090cfd3809eedead23

SHA256
a0af80b0b75446d4872577f32e69cb74b85624db2f11d0c2ec92cc4bb9cfb19d

SHA512
9a586707320f5fcefecc11cc6add3d232bc0103a23dadf356d66b2532e40614ce2143013d6901cfc64bde4ea435d0af614e8f2cf97066a320a5b5310b1ca01e8

Download Submit