bd4a1fb8f1ccb0d91eda92eb76c7dc3bd1ac026a3521599f5f219df0a88dd321

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e29f333e1a028bf02683171395756240N.exe
Size

51KB
MD5

e29f333e1a028bf02683171395756240
SHA1

48c5291e4f10a031f0f19e1990786cc8be9b01be
SHA256

bd4a1fb8f1ccb0d91eda92eb76c7dc3bd1ac026a3521599f5f219df0a88dd321
SHA512

040e585e95957cd63f8ac466d0f502c3109622716c82767a5d5d72a8cef47abfad6c39fe8c287b5f7cae651ac3ad8f832a49ae49a06210dfaa359d4f5ccdeb21
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcSoxo9:/7ZQpApze+eJfFpsJOfFpsJx

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4670) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\tr.pak.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\desktop.ini.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClient.resources.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp	e29f333e1a028bf02683171395756240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp	e29f333e1a028bf02683171395756240N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e29f333e1a028bf02683171395756240N.exe

C:\Users\Admin\AppData\Local\Temp\e29f333e1a028bf02683171395756240N.exe
"C:\Users\Admin\AppData\Local\Temp\e29f333e1a028bf02683171395756240N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
51KB

MD5
f9941450c8ee19fee77f2d467f62e872

SHA1
f62947085907bb34c3c0cd1d84ef48242668198e

SHA256
2ca9abfa74e635fd60d9b13290dcef4108552952de2de1efe993cdb63a7a985d

SHA512
436cd1dad21bcdd65e9bc974a28f9e9d54304a248130f6ab2511bbdd9a3ccb9a3cdc320cb9d859ab3f4ac4140e4b1b70eae708838d6e5d8c063642d8bc1625d2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
15c74645d5ae9438afc0ff5138200218

SHA1
1324c417159be2ca418f3089cfb89ca8dd5fde25

SHA256
c674940718beebe4d640549c70593136211623e6c06045fc00c733676ce8c2cc

SHA512
6dd2edb9f0e03af83a522d74cae591f3bb30387be6157584fdd5efd11afaeb889479176077a4d1564b288ce671a359dba7109aa9f016781730d5923318032631

Download Submit
memory/3228-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3228-1982-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download