e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
Size

49KB
MD5

6d77320a5454ca41861aedc3eea4a2b7
SHA1

9ed68188f0e8fe4954a255022db781740ef875f7
SHA256

e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e
SHA512

b7352dd355a68e7f694e8c290a4012fd8ee3a97c5eb5e53409ad30925ae0c8e06e9e4d787b6740f06e0ba89c2f4d026fe57b8e5b418ecf61cc2d0b3f31154408
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFew/DbAGw/DbAXoVRO8iJfoVRO8iJp+:W7ZppApBULcfpHLcfpyDoAI9gRoRR

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4872) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe

C:\Users\Admin\AppData\Local\Temp\e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
"C:\Users\Admin\AppData\Local\Temp\e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4124,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
49KB

MD5
07ffb3b8ea6ecb7687156555055c1277

SHA1
8fb4d0be4e6dfe9cfbdf22eb4cfecc2d0c494b3b

SHA256
f87b5360cf163281a0a2d8a126f82afb223771097883a6a2d57dc500f551d1ab

SHA512
0d95e06760c5461a91cfbc0a4525615a2dacabe43d778c4ccd5e5e433fb44661d0dbfa5363ab26caff3b4fd60d2910e56f47bd81127a20b7ea42a00e1da04ded

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
161KB

MD5
f7a6a31fe5dd99a547b2e499b7e0278c

SHA1
6b3fe166f09bbe9bb1d0d7cdda0612cd65e0c3ce

SHA256
f9decc9ff50ecebb283a6b22addae5f18e218f83de1871435627675cb195568b

SHA512
9330cad6c081981cc49932216243e022b1227472e36c105195a6746298cc731b4dbeb373872504181b0e009ae436ca4f91dc726d586bc51cc2f840cb88c17e2b

Download Submit