b5282cb0cb15b8ea03c9a78062b88893c9e8c777b04239c17adc99a6374af38b

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ec8d6dc11834d619b41acf29aa406000N.exe
Size

74KB
MD5

ec8d6dc11834d619b41acf29aa406000
SHA1

393a4ae602bda498e45f2bfceca4cb3d8d368761
SHA256

b5282cb0cb15b8ea03c9a78062b88893c9e8c777b04239c17adc99a6374af38b
SHA512

bd12e2daa34a60aecfe81f3cd733708cb55f14f8e670072d9a167550f7868979c6c61f6855cc857c0f0f8ff32d216b35e64e57cb29397dfe22b04902fd9ae38b
SSDEEP

1536:W7ZhA7pApvOsOKk4HBhaGwOQ54xEINC9g:6e7WpJaSlN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4538) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	ec8d6dc11834d619b41acf29aa406000N.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	ec8d6dc11834d619b41acf29aa406000N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec8d6dc11834d619b41acf29aa406000N.exe

C:\Users\Admin\AppData\Local\Temp\ec8d6dc11834d619b41acf29aa406000N.exe
"C:\Users\Admin\AppData\Local\Temp\ec8d6dc11834d619b41acf29aa406000N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
74KB

MD5
d2f2e9d0544a0b5321860185f4aedb0e

SHA1
26f0761002d6702d9b9447af870aff3f4b67672b

SHA256
6b99d55ed7ae076595c12386d7a6274bf7345ac7873ad0817fab3c63adc73723

SHA512
319a202772784e306068334f3a150b65d65ae83edd7090b04e2e4f3afd86b887e2eb310b26ca6f330ff57d8120031369a2135b8e472be94867019f5c5bf78f29

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
173KB

MD5
90e2399b6306b8d3a15a163bde3651ef

SHA1
047e594d2e75c06afaa41780b44a340d47377649

SHA256
c87d7f5d025aba681410ca8e321d9b6deffd12646495eed47de54de2a747b431

SHA512
ce0a86ce4e823d9541b09ca4d82d21e387d7f914a5f8c05b21345690a44153dfc1ee610e5615d5f3253f5d0ad49763674a93f1737c7d3dbf59eba8433271b6c6

Download Submit