10cd287a32e47826d20fc0733f3604f8268b9a27c2fcb3089d82b054e6c7a620

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edfed8fc9e2ce3a535707dbbbce73620N.exe
Size

45KB
MD5

edfed8fc9e2ce3a535707dbbbce73620
SHA1

91d4c55a6e98823fa4649a0b9e04e97e74e4a477
SHA256

10cd287a32e47826d20fc0733f3604f8268b9a27c2fcb3089d82b054e6c7a620
SHA512

9279344d37a9dc0fb35f75dec96a593dd671ee8489f0c9df0c5dcb5fcf0cb6620bff73e1ec9a62c8777c8eeb97a6cffda9123bbe87429de1296482f28e83d763
SSDEEP

384:GBt7Br5xjL9A7AgA71Fbhvnqj7jU7ubTAgpbuvx10AaIdKB7ubTAgpbuvx10AaIh:W7BlphA7pARFbhL801VvM801Vvv7cYf

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4670) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	edfed8fc9e2ce3a535707dbbbce73620N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edfed8fc9e2ce3a535707dbbbce73620N.exe

C:\Users\Admin\AppData\Local\Temp\edfed8fc9e2ce3a535707dbbbce73620N.exe
"C:\Users\Admin\AppData\Local\Temp\edfed8fc9e2ce3a535707dbbbce73620N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
46KB

MD5
09b74b82ea163a61ab99bd1f0e7b947e

SHA1
3fdae7e2e967057410a1fd8bdac4029c4c062685

SHA256
d711f1c24b96b55a027ff6208d48dc30c766f0085287a2f1c2e5fd8da33134ca

SHA512
564a6f756c3cdf09af1fd397203d03629b925a5a6e9ad79f20b642d26837aa82f1345bb1f3ec55fd5cf7edddbd3add40ab848af102750e47dab12f454df93bc3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
07bf7e89fb10d8b8e5c7700f32fbadac

SHA1
3c740f179d0f9cb421818bc919b614bcada0cc82

SHA256
df1bbac81c46cf642b51cc5bdf3bb97c0cc1b631b571ba644b6b87bec16c9a1e

SHA512
9028a699d2ded474b4b369ce9ceb3d8fd269e242624bc3fd2479f9dc2cf91d4a81ad6fedf19b711387536e2eb030a661b9c56059bfaf52429370286a701c24bc

Download Submit