213ee11e9119c34ab802ce7cde3ad54d491ef6576ca5fba19d2112d16759299a

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e0c121e073119c5f262bf0c851a31e0N.exe
Size

42KB
MD5

7e0c121e073119c5f262bf0c851a31e0
SHA1

98b7d5c59852707496bc99c38c1c2fc3121f7bff
SHA256

213ee11e9119c34ab802ce7cde3ad54d491ef6576ca5fba19d2112d16759299a
SHA512

40720ca12d819dade813ff62ec5c4384c47c0e19a52bb0662b5d907e5665907a574dcb084d33a350bda8872988d78560563448d92c01514f488f863163ed5507
SSDEEP

384:yBs7Br5xjL8AgA71FbhvsDYcUYcG0Wp/pHV90TV90O:/7BlpQpARFbhsYcUYcgp/pHVmVr

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4693) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sk.pak.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp	7e0c121e073119c5f262bf0c851a31e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e0c121e073119c5f262bf0c851a31e0N.exe

C:\Users\Admin\AppData\Local\Temp\7e0c121e073119c5f262bf0c851a31e0N.exe
"C:\Users\Admin\AppData\Local\Temp\7e0c121e073119c5f262bf0c851a31e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
42KB

MD5
ce3efa269f539c5b0c9927870bb436e6

SHA1
d1f469944b9be6f01c2b491977b5ed4a7902a0bc

SHA256
2b5cc10f9e17857f3a4b2081e3fcebc0d9962901bf8edc3d2a17962edcd561bb

SHA512
331ac40d71bddf38e78a8d2d8c78e93bb2bd389c451f6c0827d3686006e16108de29aba507d7cbb38b41b78de5b0217a004d98e9fddc42e08c099069fe808894

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
c86438cb575e8a5bdfefe7d0b717cf88

SHA1
dc456efbf3d7620c1ebf65238b470bf6ebe1b556

SHA256
9a96cc726ba8b599c54bdea036157ec0d62a93939ecdeecdb979898169e7fe85

SHA512
c138df8e0e17ea5fff21d86786edabbfb23ed761462598ee2b4583a57c6e044f02ca41c18d1e2a0bbbfc5574a21257bfff94d389d9a3f7f73e26a88e7cdcd0c9

Download Submit
memory/2056-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2056-932-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download