e62a54ed304e2d5f1a7fe20374ad78ce7275a0b05d0e0015a579223f393f4d7d

Analysis

max time kernel
150s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

819d5b5fc2028878a06c48b42ca4b580N.exe
Size

105KB
MD5

819d5b5fc2028878a06c48b42ca4b580
SHA1

df370d66280f0af88cd1c64fabd3428bdb05d690
SHA256

e62a54ed304e2d5f1a7fe20374ad78ce7275a0b05d0e0015a579223f393f4d7d
SHA512

bca9b941a6ffcbbc41bc2cb677ce38e5134363d9d9a990cf6269db4ab55aefd9d77ecb6790ad0a13aa64103e039e538b8af3565ba718e63eec0ccb6563c3472a
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7fj:RqKvb0CYJ973e+eKZOf7fj

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5025) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.png.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\desktop.ini.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bn.pak.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	819d5b5fc2028878a06c48b42ca4b580N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	819d5b5fc2028878a06c48b42ca4b580N.exe

C:\Users\Admin\AppData\Local\Temp\819d5b5fc2028878a06c48b42ca4b580N.exe
"C:\Users\Admin\AppData\Local\Temp\819d5b5fc2028878a06c48b42ca4b580N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
105KB

MD5
b347a15c7057c58b382a35f8470829b1

SHA1
207790410dd10608031e4ce34d8ff92b213f51bd

SHA256
75236869d7253a555ba3f218b954aba32053d1ac7f3931f22376ea64dc968f3b

SHA512
8f25bfa974b45f54fe0681ee45c7ebe02dcdff8ba3ef2bf24429e1917092d7329da83d110138b81b0a98697554ec47eab72ec8b5de8f46c9f9d268e49ca9ca9e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
204KB

MD5
4131d42a87abfd6b2871c8b195dbefb5

SHA1
47724f7b4f7d03386ec12a5452d8fd0aa37c75aa

SHA256
fedcb92413e218dc313ac077e620b27eb468dcf9d6034006e0e690179e7dc87f

SHA512
adf9bb47c727f11e4ae5d79575da7a22f15b73287acd3c540b075f0477bc93b51d9636c5065856178948f6f974af9bd93b938ae2520f2586a93a724ce846949e

Download Submit