ec32f8fd9bc1a73d77291bdb2b41d11eb017fe859c0a7d555c3105a530c54fe5

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

213c852ea6d6614a4e0916dcda3331c0N.exe
Size

77KB
MD5

213c852ea6d6614a4e0916dcda3331c0
SHA1

89e08e46de4a939c7fb44887a2c479e360bcba5c
SHA256

ec32f8fd9bc1a73d77291bdb2b41d11eb017fe859c0a7d555c3105a530c54fe5
SHA512

42a880e47304771392a6fa390f17871ea5997f63ecdc4cba7d9003f3cfd228a061017a4079e922ae7cc708a07a9d8fc3891804206370094586d0adfc0304a6a8
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZv1+CdwEbdwEf:6NLWpCZIzjwHwt

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4642) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp	213c852ea6d6614a4e0916dcda3331c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	213c852ea6d6614a4e0916dcda3331c0N.exe

C:\Users\Admin\AppData\Local\Temp\213c852ea6d6614a4e0916dcda3331c0N.exe
"C:\Users\Admin\AppData\Local\Temp\213c852ea6d6614a4e0916dcda3331c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
77KB

MD5
a7b4f4307893a12e6dcaabbf6316bde5

SHA1
693b4852df1f295bdfb9ef3768b1183301a0b575

SHA256
c361af671e91c2d64f68568c149604e76aa405181d0473be83e3055030e9044d

SHA512
42ea2c85aedbc6d2895955fca0c09eedf20a11b180c0f6137458d5e6a0294ad924997ce6842843e4ded63bfbc64a6437201a137f8cb11e6d78341cc297493033

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
176KB

MD5
f77dfbef3a1047811af202dca49e1a2b

SHA1
79e00d28678a9e1ea428f46e8894c5b5d82b8410

SHA256
5e8c068c52a179a6dbc2441a155d205ed0e509f521530809e305aa3f6abffaca

SHA512
9fbf3a3f66e6a9de7e448e7658fa0186ea7b369ef96dbebe5cce9be268be1adc08c2de90ea827bf380f2799b1dc2a2761f70ab8e2934c65f67825df99d0d8ca1

Download Submit