e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7

Analysis

max time kernel
150s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
Size

87KB
MD5

473b023db6e0286853974a24b1ea7e85
SHA1

8cb92f767291f2571f9fda26bf625080874b50a0
SHA256

e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7
SHA512

3df779c0b8655a3cd338cd2c9e97c513c3b02dac7c7f4082ec713a3f58b2f3094d96c08870e03bb314e0ca271beb92dd6e769a755a4b652b9fb91cbde3ed86fd
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYk8/:6e7WpMaxeb0CYJ97lEYNR73e+eGGv8/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5161) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\PowerPivotExcelClientAddIn.rll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOCR.DLL.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\MySite.ico.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe

C:\Users\Admin\AppData\Local\Temp\e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe
"C:\Users\Admin\AppData\Local\Temp\e831720fed20cd3a4485154dd0fb015dd65f127e03464db3521837fa5dffb8c7.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
87KB

MD5
69c090e6c6ab29b34ac943b7003f440b

SHA1
cf0f3b2ac21b84174a1b60c23ecdb092f5885204

SHA256
5beaa738e1e9c60883244526e42862a97887b94d49392168c9550ed1b7eb5935

SHA512
cf4bdf7e7c405561c649d54902d29beb8f7f0130069cd6d9cfceb9619f4ac4245ad36d04abb9a8bb69e2f4e0ef7235db45c4340883e7eae72c5a35a46acae042

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
186KB

MD5
3d30188232e5635b22a131868a3e6be4

SHA1
3fd7c8ffbfc1c09f68b5c627f2f77b1cb4d8bafc

SHA256
ca4fc2cf28fb0bda79589cf443727dcada4cae19520f0315f35488c4df69b03a

SHA512
dd05d110216c57d2f2b7288520ec8bfecd5209c443d87db0abd6fc6dbd12b4f37834fd23f44f6688a9a9e8131274b3935d8a006df01d9bfe0b8df3ce308cef2f

Download Submit