4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
Size

91KB
MD5

0cf873538df1fe5f5075105c3b02729b
SHA1

db8a49069fbd76b46daf5c54c4b6123540014562
SHA256

4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392
SHA512

ca2f5b2da9b11a4f629395325c53eb4aeb3e5e5c7b91612ff246b1b9e67b450da0291feddee99bf8454b0c1c162f44768af2f4b2b43db41bdc24d45318c8c535
SSDEEP

1536:W7Z2sspApGg7bobSM+t58qKcAK+j4nI4VfNgZ11PED4gJQeAAUZa0EzOMy:62ssWpGgrM+t58qKcAK+j4n7ByeFUF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5054) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.boot.tree.dat.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe

C:\Users\Admin\AppData\Local\Temp\4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
"C:\Users\Admin\AppData\Local\Temp\4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
91KB

MD5
4c0b26be621e87b780821e55d4b64013

SHA1
ed08becf379e6012bc7b39ec14cad0820cc1c515

SHA256
320ac5726cf9cc259b01dedd3581d1ac34b42f113af02b98ab67d2d85a212ba5

SHA512
3eb71599e7f457416aeeafaa17f9444ced6bc434b892e14244729e661cf8f156da8f5c911158d838526fec715593bea5bb333d337fd6f5363582aeb101b87155

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
190KB

MD5
1b0106be4a00afdc9cc5bc13818a5664

SHA1
013a8aced6b0705d33dec782079377eddf3f1654

SHA256
fc3fdc5cbcd7f7e3e3f028a72cdef0b32ed0544050e9ccbefbd6e80924506ae3

SHA512
4c7c4267d1a051ab05d1c5f71387626b7f6e343e223ff796004d71023079b2cfcff5b0852097efb20fc2133ea1aeaaa101a664898b854c25e93145e9a63c578d

Download Submit