e65a085d4831fc198953a7baa58faf715ee4cdff252c5fde57a024e2d30d58fc

Analysis

max time kernel
119s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c734b5370f55fe9b90411981343fc870N.exe
Size

50KB
MD5

c734b5370f55fe9b90411981343fc870
SHA1

11387f56f18c84de8e08041d4ec901a75b780942
SHA256

e65a085d4831fc198953a7baa58faf715ee4cdff252c5fde57a024e2d30d58fc
SHA512

f03c61e7ae8dac121f8930e5a0325e9c86597937a3f0b539c8086c9637b1845d337cbe1628df83376ff0ab5de87548cfd5211a2dc04501cf268405c1def8ed58
SSDEEP

768:W7Blp+pARFbhBgnKLMWK9WKrqAJwo1AJKqAJwo1AJE85c5S40g40f:W7Z+pAp2nKLRKIKc6MLgLf

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4646) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\csi.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\preloaded_data.pb.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	c734b5370f55fe9b90411981343fc870N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c734b5370f55fe9b90411981343fc870N.exe

C:\Users\Admin\AppData\Local\Temp\c734b5370f55fe9b90411981343fc870N.exe
"C:\Users\Admin\AppData\Local\Temp\c734b5370f55fe9b90411981343fc870N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
50KB

MD5
66ef01256fd998189df89602162d8704

SHA1
675713b72a600b6dff70410530250198d8c8b428

SHA256
6614ec8698069fba41ce87dec8f1c75a33a163ca5400a43919926f7c55b0c3bb

SHA512
b46ef45bbcf275c086cf1fa0c1c1c69c2ea52b5cfb3f371eb40724b3076ae4b39df5abe492d6eaa69515347e1d584bb722871d4819886b132d50de1d05f8bf47

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
2afd196072d4ad73d59023081f4fc2b5

SHA1
76406dd98f8b5311f44719fd78c63d345ae62900

SHA256
579cc616739b2ced67f34951535f375e0c5556be7c95feae995f0469c4cfa08c

SHA512
47dd69116486ac61fe6caef3a70ec68c400d6400048690810ee51583f2ba0efb6c1240199d8b1be51aba26dc506cb1a5274bac09970a9ea1add05d3764a8a80f

Download Submit