efebfc794763569a20137151dc174fab07e2f233f2fb3bfdc63b64d9d68dc783

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea34ef95f49ac98e6cba016a47db9240N.exe
Size

83KB
MD5

ea34ef95f49ac98e6cba016a47db9240
SHA1

4d9f15d3f7d3fca614baa147ec7dd9d17edc41c2
SHA256

efebfc794763569a20137151dc174fab07e2f233f2fb3bfdc63b64d9d68dc783
SHA512

6f249fed33f0425e50663ff48f7283056039756ea1595c05fec57580d2242ccc45a628ed4f812b9632e22a254e4f47612072e96669bb8daa7bc7139c28f21517
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdTTXTs:6e7WpMaxeb0CYJ97lEYNR73e+en

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4613) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sv.pak.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	ea34ef95f49ac98e6cba016a47db9240N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea34ef95f49ac98e6cba016a47db9240N.exe

C:\Users\Admin\AppData\Local\Temp\ea34ef95f49ac98e6cba016a47db9240N.exe
"C:\Users\Admin\AppData\Local\Temp\ea34ef95f49ac98e6cba016a47db9240N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
83KB

MD5
507105466789b01f63239b37837b53a0

SHA1
d3723e37209a555fcd2f6b19b8917428cc940b20

SHA256
c7aa4cc2f30bc61a111e65fe3239a29f3e7e0be588ae30ebf01f4c6fb76af9df

SHA512
9efb8d7a5227d6e869d0d6aee23957aaaaceba504feb661a62c833f0e7befc06afdd2795042e3c963cc0db09114c476ebc7fc29b1ad8d3f76edddd51bd9b7f37

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
182KB

MD5
7e915457ff85f190d5ab281c7340ee0f

SHA1
c771c6819d376c6f925fd0c3aabd85a71ccce117

SHA256
dc5e491a9add5ffe0ac3d35a17a8600fd37ade72cb6d96092eee75b977628bf7

SHA512
103a6494d767e8c83d45786b55de46ef72fc2a2d03598f48a73edef291208c1a05c8eb8b628ec5be155743ee476f566cbce7979b66332321561c7eaa2c3b0034

Download Submit