f5132236f7c5340e31583bcf80619cac7fd4cfecd30e8377895a7be3f633fa7a

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 14:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
Size

83KB
MD5

e9bdb3fd5d73fbb1b090f8ebe1a07220
SHA1

6fea6b770f1630acb2a83fa157e43ee1b64181c4
SHA256

f5132236f7c5340e31583bcf80619cac7fd4cfecd30e8377895a7be3f633fa7a
SHA512

e2e7819cd568ec56356f8d246e03a18c056964c1215623cb5f0efcfead5bacde8e674218b66095ed14779e433399c445a1e30c824b250a8af0cb00bc1a33eb38
SSDEEP

1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlES:6e7WpRaSljeS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4621) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\mojo_core.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe

C:\Users\Admin\AppData\Local\Temp\e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe
"C:\Users\Admin\AppData\Local\Temp\e9bdb3fd5d73fbb1b090f8ebe1a07220N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
83KB

MD5
a52e141487d0867bb3d663d3fa907d58

SHA1
01acf0e50902bbed45bb178cc13760d4115d7c61

SHA256
78a0b0f033a9fc4a75083585aa7fd14b8a383a0fc6a9324c1b2d8a4ae309388c

SHA512
d9497abcbe1d6883d155fb2f9bce4f7693c19c503b9005a405670fa7403b3ba78d304847bceeb6cd575a2cf1c2e79db2b74ca8610127654e7311f09ca5f01730

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
182KB

MD5
504eacecb354e191849cd6b4545e0949

SHA1
4db0381e5c5201743cd7ec014dd1278008f64daa

SHA256
684d526e1e7d24cd75f8d227d150b3a57427b8284efb7c3ec65787bc5fa76d36

SHA512
ebbff9246c48b1d8112cbec0d94ce0bfe8cfa52aadca48a8547a8ccf59e5076924c155625ee9fba87741f1e9a0db3fb8adc8226e66d48c4ad2aed7d7e032e436

Download Submit