ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed

Analysis

max time kernel
150s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
Size

39KB
MD5

889e67d871f9e500d728a627bf056ab6
SHA1

021d087c06dcb0f6f84fe88e03bd87869be8c698
SHA256

ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed
SHA512

d76b89a14a9245b8d88a51403c4ff35fcd1d0ba56e60d201dcc4fda5e788b242f1c17604fd1701cb6025820a7087b25c394b8702ccef4290f6cc6f326b482db1
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/Fzzwzscuc9lUFTlUFt:/7BlpQpARFbhNI6FuFt

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5251) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICB.TTF.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-BOLD.TTF.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAB.TTF.tmp	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe

C:\Users\Admin\AppData\Local\Temp\ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe
"C:\Users\Admin\AppData\Local\Temp\ebcd3cb583c3b20ccffa7f78187cae6fb34efae6f06b02457271b93d713e95ed.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
39KB

MD5
f50b1c4f75230b1e9fd0d61f54799c4d

SHA1
09a2c443c11d691f5589e09c03997899fe966760

SHA256
70f0dfde415ccb89be3f77be4968990820ead706b8adb3680cad17fe1468b4a0

SHA512
4eece64de0af5a3ad31fcc2d23a288e69a17f4550f262366e0725e56b6683f4fda926da4b2cde6d5895cd4908acb6fcfbbf0ac04659b5ed31aab490de7b8496d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
138KB

MD5
f759565abd1818afe4ed76ee43ad39d8

SHA1
bfe412c44a7dd16f2ad7cb000fa856293b89cd2d

SHA256
92243e27d2680b2aaa4edc7adecfd48f4c688607b9ddd6a6328c0a6e3cd86e2f

SHA512
e463b75da8f541e85d43997700352c75cadee6ee9fdfa043c1f3ed236a61ed4e0a90866ea694079b1c6fde8d9965fa6c223d4355877f3e0714a2ced3f23539de

Download Submit
memory/4740-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4740-922-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download