e179c8fe513078e43f84b0100c24fd1af682504eedd83e36757cc86578f2cb2a

Analysis

max time kernel
120s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

339e4f8109e8daf5ea083aaf2a4eee20N.exe
Size

80KB
MD5

339e4f8109e8daf5ea083aaf2a4eee20
SHA1

e59c36a66f6785657c1012920611cfb26a337474
SHA256

e179c8fe513078e43f84b0100c24fd1af682504eedd83e36757cc86578f2cb2a
SHA512

c464534a8cbe7ae39ad2dc770db7379a0eb035fc2ad38c146b5646671dd4a463e8a48ba9d4dc7d8eb77ef09e0f39b80b9bbde2be7b97efe8acfcb6a672fda842
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzY3:6e7WpMaxeb0CYJ97lEYNR73e+eGGs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4352) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\he.pak.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogo.png.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lt.pak.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	339e4f8109e8daf5ea083aaf2a4eee20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	339e4f8109e8daf5ea083aaf2a4eee20N.exe

C:\Users\Admin\AppData\Local\Temp\339e4f8109e8daf5ea083aaf2a4eee20N.exe
"C:\Users\Admin\AppData\Local\Temp\339e4f8109e8daf5ea083aaf2a4eee20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
81KB

MD5
a416505c9c1528349c6057e9547fedcb

SHA1
ab1b716e75eefcef8252fa37a5f799fed1d5e1d8

SHA256
62f3108bf7d20472ae5b2c9eafb05fa6b066ac62264cf3dd81077dde4feab173

SHA512
02c022459e281f5f78e5ee0a6577c52c6a4009286fc8d68783c474ad60feb159b4454f985bfff3452d612fa7f04f00651570174d45d971f872f1160ddd0e6250

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
c81de8cb768dc18ee008c09d1c114bda

SHA1
2bcd6b1df354bfb492e1e281c5761ad2175ce2b3

SHA256
82ab18f638dcb830b12fa45f1617f3d4a09eba10ffbebe124c88afb0f9d84a0f

SHA512
e4d1abb15e3ddddc3a14c936d438be9c3fa6881314bf2ebc6dc610a670b6e5dd26e13630fb87bca513b915636a6bfa28738b2338f1cb15db91572bd98035f090

Download Submit