e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec

Analysis

max time kernel
150s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
Size

46KB
MD5

3dbcf7a2b6eb949832230377834c2363
SHA1

aa9b3bad5763e569bdbf4253a20259c6799272d4
SHA256

e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec
SHA512

578f3318755d09eba0028248e3ae34a555c087445cf0eb25afb2cbc72eb41e8eb7d8c459129372e0cf1e6635e801da20021190b925f9cad7d5fe4f017a675846
SSDEEP

768:/7BlpQpARFbhNIiJwsJwwnZEQoVeDQoVeJ:/7ZQpAplJwsJwwnlYN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.ProtectedData.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\af.pak.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity-dark.png.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe

C:\Users\Admin\AppData\Local\Temp\e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
"C:\Users\Admin\AppData\Local\Temp\e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
46KB

MD5
c475d119ff4357925dcec65448e91d8e

SHA1
34aa502624dc36e00f3336ca2fb559b5825127c6

SHA256
5986fc60b3f65d0e85a3f2bc3bbdcb2294e8e524040ee7718a35ddbd9cadece8

SHA512
fe0e01bdf3d06c2b63a439617fa8e864c99de45559a5977bd185f798df60b9096e8bfe7e3b860a7d6ffb62f8d2ae31244a1733a9735a3e7b09ae76dfa8be77e9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
f0b10943562c865e16f8a3b90bdbc51e

SHA1
eee6eb11bee33cc5053d662c2652722984aa4a57

SHA256
45b62bf866ba4ec84bdd2978bfe762d6320a0599555e694355bd9aa20d5f859c

SHA512
7ff3a9a1e2b25ea719a10e234c689b579abd1e476429a9fea4640261c2cf907bd2341e9da187ea87dfdf048145b3a5dd540f5a91d63b2c6c6985a596c0fe7e58

Download Submit
memory/4036-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4036-814-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download