557e12f3b202ab32c105f3d8cb15241fc1da2af9f80c15796c3fffed38fb9e6c

Analysis

max time kernel
120s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2e793b2469f807dd06ce57e3e2f9ee0N.exe
Size

99KB
MD5

a2e793b2469f807dd06ce57e3e2f9ee0
SHA1

38544199a914de6a4e947fb6dca4ff0aaf7b059e
SHA256

557e12f3b202ab32c105f3d8cb15241fc1da2af9f80c15796c3fffed38fb9e6c
SHA512

df4392545627aa7625c7f66ac99a15a552cc5f4d21418e38d7c1cbb09697967520c85fb4ca3674942a0eb6dabde08e98718a08d8ebe713601ed70acfd826720e
SSDEEP

3072:9QWpze+eO888888888888888888888888888888888888888888888888888888L:Lpe+ekeq1l

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4612) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\cs.pak.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\et.pak.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	a2e793b2469f807dd06ce57e3e2f9ee0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2e793b2469f807dd06ce57e3e2f9ee0N.exe

C:\Users\Admin\AppData\Local\Temp\a2e793b2469f807dd06ce57e3e2f9ee0N.exe
"C:\Users\Admin\AppData\Local\Temp\a2e793b2469f807dd06ce57e3e2f9ee0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
100KB

MD5
89db3f71c5b7bec93b63f6df1bc83fa6

SHA1
3aa2feb5b6baa898566ddbcebef46d1108a48df0

SHA256
e55635ee2bae1c2f7772fe1cb47a02f519f86cd7458db77588bb9bc913486313

SHA512
b94592682098d6173f9e545bd5bf37fd384c6b3782e7f8e7fd1b6de7c7fd562fbcc40ec9d0897e70e4f80a20c1d160138d91cefd30206807703ff7373af6a3eb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
198KB

MD5
8e92ad72b55c9490d1e22921f9186099

SHA1
b25eabc655e42dc10d545357b69070ef1d8a65a9

SHA256
d0123716f098cc4bdae25322ed45488a95073cc785b4b801732b97b292bd98b2

SHA512
a0da2a61e8d14a2a426a7ac192081bfb6d70f18fc0bfca2739969b6cdf9d4898a8150addf17a85f0829685c75652b3a5e4267e40ca4cdaf07be6628e98d756c8

Download Submit
memory/3444-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3444-1862-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download