80e2fcd6255f513ac13c879f9461449baee8f16e66f59a77e628e3a645162d1d

Analysis

max time kernel
120s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e32e3c628b8630b6350519fe6daa7250N.exe
Size

52KB
MD5

e32e3c628b8630b6350519fe6daa7250
SHA1

f666c4ed5b137c91c0d8eb7a09e9fe9946147a44
SHA256

80e2fcd6255f513ac13c879f9461449baee8f16e66f59a77e628e3a645162d1d
SHA512

c490f2f8f67ea2b4cf75bc05587e9c05ba5df2ddef533c3c20b2addc8cca7f353def2882c1c1438af11aaddba013b23f04b4188830168154d1f1fb2f64c3e69a
SSDEEP

384:GBt7Br5xjL9A7AgA71FbhvnIH2YsTKnKqtaW3WaEdW3WHY3SjSFvs7j:W7BlphA7pARFbhvOsTKnKqtkYi+Fvm

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4652) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Java\jdk-1.8\release.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp	e32e3c628b8630b6350519fe6daa7250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	e32e3c628b8630b6350519fe6daa7250N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e32e3c628b8630b6350519fe6daa7250N.exe

C:\Users\Admin\AppData\Local\Temp\e32e3c628b8630b6350519fe6daa7250N.exe
"C:\Users\Admin\AppData\Local\Temp\e32e3c628b8630b6350519fe6daa7250N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
52KB

MD5
c46e5fbf8d5116c070664e62de17e9ec

SHA1
12b6a29e3273d3a8799fc1803b9754c4586001a2

SHA256
8ece7622f31d3af1719bfdbef267106f010ee1845dae9f4de5e3c69a32c11871

SHA512
eaf6817991844c8cb92d7edd6be561737c310cd82d52dc029fa96534f05cb37b0d0ed725619718e8bd46496970d37e737f79b24fcaa69d91c295e9e00de4631a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
f0f2aaee9c4545c487c3f7a189a40e3b

SHA1
5f7aae21c9ff22fe2085703b3d0493cf098905c8

SHA256
e8f5a73d2fa5e4d0cc80f130f042ccd77e3b154d6509ea0c5326e0abc420bcbd

SHA512
bd261f113e26668132236bb313e6edf2b9f1b9e5032ed35c5586b29562442be4f9c4ccdbe7ff4fe3564de38e74693650b27fda03c3943e5d1874d52cf9393ac7

Download Submit