e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
Size

42KB
MD5

47ca3e27df241b211eaf42bc68ce681a
SHA1

2a233f6f4d8bfdfa1355e4dbb23b679145f72ea5
SHA256

e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0
SHA512

f5fd2aaca24cafe775f3ae4c5d4699e1a756357a217b2e56e952f040e4f1b090499d7d90fb21ee4c6c552460d182ed92f20068fbb846211eeda2742f28fc5f9c
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FzzwzDojo4jZj8:/7BlpQpARFbhNIDojop

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5205) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\kn.pak.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.boot.tree.dat.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\InstallUnprotect.TTS.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\mojo_core.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe

C:\Users\Admin\AppData\Local\Temp\e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
"C:\Users\Admin\AppData\Local\Temp\e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
42KB

MD5
db8290b4e169b070dba1e3662d6dc079

SHA1
ab3d09d2bbea492cef0cdf2ceef398b0164471b7

SHA256
bba3cee258c254a226ddb9079c39fd2809e4ba2fb79ca25afe4a41a739ef45c1

SHA512
a3bf8383ee24e883bbf3d17863fc4a9d24d5a59f4fab503f4d2ae5a7ef3dd1172b8fb2680d360f47dd05b1d7a153a87361a4e1eb60d8ff263aee535a5586c6f6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
9565540bd4745a914c2a7e9eba9f09fe

SHA1
88f69924946109e313e2fdba08081d80aaff18d3

SHA256
bf76b943646a1ab1dadbcca545071b7420485c00eae69cd6e584e5773ce28db0

SHA512
794ddf1e8f9d2f60cb8c4b2adee6dcb2da4575b386bd2205e3f81d3bfd58852edc34fd997b9a007c51f8340a70490ecf96abc5699f2430e44b6775485635ba16

Download Submit
memory/4532-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4532-898-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download