f13e0423f923fef4b39d4dbc4fae5a69eb8adb1bb9fca95962ad6cb63fc8119b

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2e563b41ffaa1b58153e212a0205930N.exe
Size

146KB
MD5

d2e563b41ffaa1b58153e212a0205930
SHA1

ca0627aad2a26d91027880a3666bbed9934d4b6e
SHA256

f13e0423f923fef4b39d4dbc4fae5a69eb8adb1bb9fca95962ad6cb63fc8119b
SHA512

d75da89b46e311b4420b528a488eceb28c537fedd59fd8183b072378a66936c196d9b9c31774e616786b72aa857bb4f4b47037debab25adf198cd37319172c48
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7f/e7WpMaxeb0CY3:RqKvb0CYJ973e+eKZOf7fWqKvb0CY3

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4146) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ta.pak.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsFormsIntegration.resources.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	d2e563b41ffaa1b58153e212a0205930N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	d2e563b41ffaa1b58153e212a0205930N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2e563b41ffaa1b58153e212a0205930N.exe

C:\Users\Admin\AppData\Local\Temp\d2e563b41ffaa1b58153e212a0205930N.exe
"C:\Users\Admin\AppData\Local\Temp\d2e563b41ffaa1b58153e212a0205930N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3776,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:8
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
146KB

MD5
25f352015458bbd822ee491a205bf9bd

SHA1
96ffd4feed5ecbc5616d720911680b2f9c86532e

SHA256
9e9045c537bdaf4628f1edbbaa5204da6af7551b6ccae2ec1b52ef84fe6f09c5

SHA512
594dea362fb8ee455432d94dbcd1d2434a52756b8b628e4ae2e2aaee4278b809a44259ca9352dffa3825bb239791cde7863decd57499f65b44442d8188d7383b

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
259KB

MD5
927528b5505d2671e162ae8e1e541529

SHA1
c5e1fb249d8fe6a40118f4e74f0bc61e4e13ea46

SHA256
d04ce9d43040892e7ae883d5877c0558467e741313648e2111341f7cc82fe68a

SHA512
fda11daa0fb9e05f2255de96cd46903fa9f1e457886a37f8a1d0f1e531635a9631d7e9c0b09a592e5be882d3d3950a21cb87effed3e00d00e228248b591340e1

Download Submit