8e8eac68b4345bc8a2a6d50ecd943bc82c8c87ede4e6092f08368c6fc2b82336

Analysis

max time kernel
119s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e74f1eb6dba0ab993e093bf224785030N.exe
Size

45KB
MD5

e74f1eb6dba0ab993e093bf224785030
SHA1

dfb16b82d1df25a3e70f15be268ae3d1aea2c363
SHA256

8e8eac68b4345bc8a2a6d50ecd943bc82c8c87ede4e6092f08368c6fc2b82336
SHA512

aaca869de26d2deec09d8fff7ad529f76120015a751c5124b23bf60900d34458454b487f446f1e8738e3d8326cbc6cbdb767ecd0f90307f4cde46ee191e7ef6e
SSDEEP

768:W7BlpppARFbhjbhQYjYY4F2j3TK54F2j3TKdDa:W7ZppApB1W5WdDa

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7z.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ca.pak.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	e74f1eb6dba0ab993e093bf224785030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp	e74f1eb6dba0ab993e093bf224785030N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e74f1eb6dba0ab993e093bf224785030N.exe

C:\Users\Admin\AppData\Local\Temp\e74f1eb6dba0ab993e093bf224785030N.exe
"C:\Users\Admin\AppData\Local\Temp\e74f1eb6dba0ab993e093bf224785030N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
46KB

MD5
000b1f289a01aa58843be9110260e33b

SHA1
3575ddf74cff7d4146bbbcd5e7000c5857db490a

SHA256
83eaf58d600a4db0d0762c66eb54e93f188e742a735dca84dc330e2ccd09102c

SHA512
aea2fc568abadfe9dedca2af52d2b807598182d8439e32e93eb7e1a92b95c62622d1fe51a284c5869b2d9dbe73a5932ed4285c8513e68441bb5e7c60643841c4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
997bf97ed911c76369f4b254b8054d6f

SHA1
430b2e627f6a69ac49f49bdb1049df7b1d199586

SHA256
2512fe75f0428cb6a1ce8ed3adbc32eac77a62c998d4dbae61f621bd38d18361

SHA512
e2df7e96d1b488e1fc1d4f8507d41d4126351dbe5b34767a83f606b5ece15cd0f5b2433a5f1759c8523fe293d33ed771fff6435061ac5471686933aae7aeccff

Download Submit