Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 18:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe
-
Size
44KB
-
MD5
8b8758eb07422956d219e254b1cd9388
-
SHA1
77be7c389caba9cdf3fdd0f83a5634d672afadf9
-
SHA256
0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3
-
SHA512
c9acc76e451c4e0cbec5d547fb9bbcf8a17e0767080929e51d918f1871ee169da1821ba44c62f2f1a6ca5088b4cd7938f2e58d2fc3190b3adea53e369dd4c3c5
-
SSDEEP
384:GBt7Br5xjL9AgA71FbhvuNBN10wpAp/lvolGClvolGwTCus7sczBywh:W7BlpppARFbhbt7Y7wTCnBx
Score
9/10
Malware Config
Signatures
-
Renames multiple (5006) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL027.XML.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnms006.inf.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe"C:\Users\Admin\AppData\Local\Temp\0e4bcd48acda010b2103c00824addccd99fabb99bbebd9e591cf1f17ef5e7ea3.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD5b70e6a336530f8fbd3ea6122f2750096
SHA198b301434042d8c8bd61b87348d8c8cb66a82b33
SHA256e16e6bdade9f3ac2f3029c8856cb35f047f24cf393f8b35ccfe77dfbb42944d9
SHA512597b7d13a77e1805a902d8478fe435e2c149e5038c8166659665fdb23c42a2401dcb9eb251009934e0c8c1697d08d374b0ef0753ac8f5160246179fda58b7071
-
Filesize
143KB
MD57bd241efdfb81d38c06ddac11417ab7f
SHA1df09b6535a98c1e6fb4e2033a0c8738a9594c834
SHA25687aab0e9e39bc5860bebfb3b3694012a8e05bcf4267980f8fec143f969a9e0b1
SHA5123049c57f4a6309741a7eca0a1b8936f13bb193a4749f666998a84710f5a28eecb232d4b6b55fa5e429928d6b08b7a775c613132021a5f8009790f3da9ac369ca