c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
Size

89KB
MD5

32efe721545dbcf85c67759104d0f58e
SHA1

d36509648ac8a8eca3a38bba507b27155b920c56
SHA256

c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3
SHA512

53a8f0a52dd28b8b55329f172109ddf0880556ef75428637e2f9658bca8af79b68699598485b2b235b47ac3091a3cb1b05658e225c631cafaedd08027db520a1
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWifP:6e7WpMaxeb0CYJ97lEYNR73e+eBSWifP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5026) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEVI.DLL.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.dub.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe

C:\Users\Admin\AppData\Local\Temp\c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe
"C:\Users\Admin\AppData\Local\Temp\c414e9160df21e4d8211e5ce0f3c3e4184a4a2d1b55a03a2f31c21905bcffed3.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
90KB

MD5
b2a5765d521628b7cde837076a5d2ad2

SHA1
2b1eea2b3c0dbf4aeaf3d22af016b43478fbc841

SHA256
dae3660dd35394e21903b8f126aa848061995ea2509e906fe82653b38214ba29

SHA512
3c672c0772dc34e347f63dcd0c15d3c76a09df8b8589984aaffa8d7ed67d863b4221979429687a20052e004566acdfff9b20358658006deec08b126b9d6089d4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
188KB

MD5
fe34049523472e84dc154429001fed6b

SHA1
31fcd71b64128e9fca200a81deb171dcd6bd5bfe

SHA256
655b0b62ae9fae7935f255365054b77a4d51a9ea2146a9c1958ec5b086cd03ce

SHA512
368106941d08dcd998058399bd7f183ed298cd8a0612df1180fb1e2503acd1dbc76a7f11701a1841c1ae92b5cbade78e24b8f78b9f689b4817b86f1ce4f450b4

Download Submit