e84dbe20dafd400756432f0f65dcb95edfe43decd8f90765c5b2ac9043520a5a

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46f98961689813289132855c448444b0N.exe
Size

74KB
MD5

46f98961689813289132855c448444b0
SHA1

76339f4f6a6954a8d6c44083f7518a84d3b5cac1
SHA256

e84dbe20dafd400756432f0f65dcb95edfe43decd8f90765c5b2ac9043520a5a
SHA512

52a23ab4b0ef95628299ea44de4a651246925d1060612c544987bea6bdfc40506763df76714f4e78370f519cdc62ba31c5dee4a7b29171e878ff7756dc8680f9
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzE0:/7ZQpApze+eJfFpsJOfFpsJ5Dq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp	46f98961689813289132855c448444b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp	46f98961689813289132855c448444b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46f98961689813289132855c448444b0N.exe

C:\Users\Admin\AppData\Local\Temp\46f98961689813289132855c448444b0N.exe
"C:\Users\Admin\AppData\Local\Temp\46f98961689813289132855c448444b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
74KB

MD5
b786810350f2312bac9d558540d94e4e

SHA1
636e37ec78b3c7d60f24f8d8aea0348fc2c33919

SHA256
ce24d8478b2f0dd9c25e70e7681d1f18f52959f1d3e20e1087d3c96d4279e4fb

SHA512
9d07a8ffc67331645adbf956e41f56e38d518f94771dfec29b38d85770f0d88d0037519bdf96ba11079a4b6acc0c02720944e4f67be20362bc83be38c5484938

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
173KB

MD5
080fdbe6e5c9c8bbe22d4876afcc54d4

SHA1
0b7cc04427901d792f818be1ab999785eabad065

SHA256
4fe9a18ae156935a983c177b3b0964604ec2789f971893a761d77578f260ad0d

SHA512
ee15b1788089b30fd222f339d11acfaf9d8c9b31cf0c46dfc030942f30988970434de1d65d448d8b9d5554abef8daf9ea35b1036d22ed3d51e267dca1ae26c28

Download Submit
memory/2540-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2540-902-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download