1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
Size

97KB
MD5

6e1cc5cd5e345ed2c09e0c0ec804a900
SHA1

419c0dd7796850841a0a105f8172b9ca309871c9
SHA256

1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1
SHA512

ead50f27bb751e9b312adef66550e6d781fee20fc5e838075506bb75764c47c90793f19d71ed0f3e976516cdcec1d69edc7d81981a06d5e4ab52554b74e39b40
SSDEEP

3072:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9ih2x2x:RqlIyFESWu0SWu86jYh2x2x

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5027) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL027.XML.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\amazonredshiftodbc_sb64.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL012.XML.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\LICENSE.txt.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\mojo_core.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.tmp	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe

C:\Users\Admin\AppData\Local\Temp\1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe
"C:\Users\Admin\AppData\Local\Temp\1e5f84715de35183a8a62e50175681e72e56b1cee60dde08ff846b37ed7657e1.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
97KB

MD5
b97bf4ede8e09791acecc8b351b579bf

SHA1
728a4b779b13a0f7f2c00d4d18103030bc8feb5a

SHA256
cbd607c472b7c948fb3f4b07f627d987bd58a23ad0009c0a94df9a8a27f2c663

SHA512
97f2b834e5877c60fe41486783ff42e84619f5f74641716a230d2b774fdcf4ff971a593a0b053ec320babc1ea612202950cacabc42006f89dc1aaa6c9a084271

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
196KB

MD5
c2bb0c8aaa08268542b95f45168ae967

SHA1
32c608b1e8273877d50350f18ccfd7875bc6b1c6

SHA256
c5c745e993c5efd0970f2eaebe0549ca779dff882795c5ceef11bdbd531c02ea

SHA512
6db158df287376693d2ea73f371fc10c56bc1b80bed267bb4b9fa8b42aa1ec688af3b74406327cadd5313eb980b20cdb4b0a2db118cf381442e83a69bcc84089

Download Submit