5c299b468fc6f47529cf0ff88501963a7925e3e0dcd49a8c5b023b7cc072992a

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce22bd076c4ecc83d97cf6709e58ac00N.exe
Size

69KB
MD5

ce22bd076c4ecc83d97cf6709e58ac00
SHA1

03bf9b0e51021fb3ea2615b1a337551e36bd828a
SHA256

5c299b468fc6f47529cf0ff88501963a7925e3e0dcd49a8c5b023b7cc072992a
SHA512

6f1a9fc9cb1b5f48b29ceccec7b9e243552e3e4314aecd0304939ba1fb17fd4db0b6f4a17b4147e2679612a00af9191ce75d5f7aa52200fca7f9869f41ef9c3c
SSDEEP

768:W7Blp2sspARFbhJpupZ5pZ4+fTgTvlK1lK6RZR+8/8gClurYClurUpOpE:W7Z2sspApkZrZ4+fU7lK1lKT8/8s

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4649) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\ExpandOut.pps.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\he.pak.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce22bd076c4ecc83d97cf6709e58ac00N.exe

C:\Users\Admin\AppData\Local\Temp\ce22bd076c4ecc83d97cf6709e58ac00N.exe
"C:\Users\Admin\AppData\Local\Temp\ce22bd076c4ecc83d97cf6709e58ac00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
70KB

MD5
960872a43b80a59c79c0a5beae3c954b

SHA1
118f363ba450081bbf8f7f77cf79fc163ce91762

SHA256
2e12d058eb7650b8285ca8a37f3f39f1fa0a2a211a4748d6112c51d1435f1a8b

SHA512
c2ea116f1c3df97d7a223bfcedff8c85d10f0f6903f57ffd0db88679210668cf75084a8b487f1e7cebe2f7b70727b77e0987b512acadca06b04e4c0c691dab64

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
168KB

MD5
594d021e70d38b3b855ef081dab177ec

SHA1
c618572088ee92b5031b93fd56b13d5d5d636975

SHA256
f7e4123b65a94e202fefd399362ce8d3b52934f5b63b95cfbc0cf9dac5326cd6

SHA512
adf8416b1417e4c2fd2ff46345d88b340fddab9321ebd65c67109e54a833c842e5093489cf2451ebbed07bc0dd657817126c74b3901426dec971458b1c6a3175

Download Submit