426cf7f68ec7e78f4b2a559ac63471425cdc183de1fe9e92138d16d43f685d29

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
Size

54KB
MD5

ee5bcbc24d43dc916ec79e5bb648dbb0
SHA1

fff0082f7e48eda334df1a4ad01ca84efc974416
SHA256

426cf7f68ec7e78f4b2a559ac63471425cdc183de1fe9e92138d16d43f685d29
SHA512

b5cc33b4a8c5073c1e8e1981c4629c6545d8c97eeab6a0a337e950fbba92b530cc09e435b5f132141541fc6cc8046e40f22d8f520f5a5b8d660bdaf86ea77d4d
SSDEEP

768:W7BlphA7dASbSjJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiaj7:W7ZhA7dABJJ7TTQoQE

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4619) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe

C:\Users\Admin\AppData\Local\Temp\ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
"C:\Users\Admin\AppData\Local\Temp\ee5bcbc24d43dc916ec79e5bb648dbb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4628,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
54KB

MD5
3133bddd19bd4307650f3968d3d89fd0

SHA1
9df9a5f78d592045cbe55ee69eeba533c4c4822a

SHA256
5024a9c5a7750b967c3a2c80c346dbab81adbbd32c8fb02c6a8fe5bac5161e58

SHA512
66d7b666279d7fcd64b28654c3dd73a652a57b56743047dd4a11c7ad8c6737d19a12443731297bb683ab39da948c7f3fb2908ecda0c87d00405e77aa7937625e

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
166KB

MD5
39984a61973da738eb76492249e6ec8c

SHA1
d1aed8741429e4619da5ee69e983ab6b9cd7ff30

SHA256
eba0939f771d1d58a02a22f0345645490fdf1ef2722b89b561d3b1f89183f679

SHA512
347c43633ce69d7b203d6932a81019d857eab534dc4c4286c3a635add1716e2a589e050a71117276b678b6b8de41cf3d075ea457f1dc8f3754607058187b12d7

Download Submit