Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 16:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e5ed9d63c96d36200d8eb020042ed890N.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
e5ed9d63c96d36200d8eb020042ed890N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
e5ed9d63c96d36200d8eb020042ed890N.exe
-
Size
100KB
-
MD5
e5ed9d63c96d36200d8eb020042ed890
-
SHA1
a579990b7871688e35683473b474c1b73f40ee66
-
SHA256
f32cfa3ad716a51a7a88a7857be6806c5023f9a3270f100d8b4fc58ab73ac729
-
SHA512
4ee4d7cbdd3c4dc33caca14c40ea0f728aa3c8b11dd106d3168d9acc2e6231c813bd96f019ba569b09f3e05375745f760faf0528d297e0400557ef95e14abd07
-
SSDEEP
3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBG:PqFF2Ie+efsLy
Score
9/10
Malware Config
Signatures
-
Renames multiple (4363) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\libEGL.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogo.png.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxcompiler.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Java\jre-1.8\lib\security\blacklisted.certs.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp e5ed9d63c96d36200d8eb020042ed890N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp e5ed9d63c96d36200d8eb020042ed890N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5ed9d63c96d36200d8eb020042ed890N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD518b1d03a89f96c66844fb4d696ee2440
SHA1227b445feed3840803a65ab2fa8780e126726104
SHA25626e633050b79d3fcdc37a7d88d200bfcc1be855b47750d86601494c4128d3d6c
SHA512885fa1993849fee9e8916b3f8c446a80ddb3c67e6097bbf7885360012b563d513c9f95692d41b7677cb20e12708e53bf96ff8ca3692771dbf568b0b8ab9bce1b
-
Filesize
199KB
MD535299dc2d8592e02139cf272e8dc6998
SHA19544486591ba4957d47f332cc263ed76796c241f
SHA256ff900a6373c69a202afd30e5ea3f203f6b247fe8fb29b80a3983f8ecc11d1322
SHA512b9f5f7543d093557d03d76be20bbbf2e1038b7a56c6ab299b3384b4aa9f5daadd1b7b3c365567f0671bf06018c06accb74440cda255a2cdd92b5557cd389410a