00fe38b2f9e4b29eda5b2b9b19344ecbecad7c575579257201e2091b14b705a4

Analysis

max time kernel
120s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4cd4575d842ed1822c15f32e8df2ef0N.exe
Size

84KB
MD5

e4cd4575d842ed1822c15f32e8df2ef0
SHA1

419c1688f8739fb99d45df5eb33daa242ffc9d2e
SHA256

00fe38b2f9e4b29eda5b2b9b19344ecbecad7c575579257201e2091b14b705a4
SHA512

d986e8781f749d82ff1d858c19cfa302470d8668c9ee76e55657a70ea78085bcff6159c6c9e2c497dd073e0ecd25b2e3ff16795859b6fa04fa3cb9dbc07d5f28
SSDEEP

384:yBs7Br5xjL8AgA71FbhvJUfWGUfHjtmjtd5NaMR5NaBQZbHN9+tcn8ID+973u:/7BlpQpARFbhiWb8naOnaBaJ9+qDO3u

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4390) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART10.BDR.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Xaml.resources.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4cd4575d842ed1822c15f32e8df2ef0N.exe

C:\Users\Admin\AppData\Local\Temp\e4cd4575d842ed1822c15f32e8df2ef0N.exe
"C:\Users\Admin\AppData\Local\Temp\e4cd4575d842ed1822c15f32e8df2ef0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
84KB

MD5
1411514b9d719411077ec4dadd33b37c

SHA1
dbd5be1390fa5281edd4bc87e66f06023235e2a5

SHA256
669e6e7ce92a61e220d252ba87373f7018abaf9a2771a51e1451dcf983b85ea8

SHA512
78c88d18a66120f54ef18a3a7b1f7d01308b1aaeb9fc4f1df5eba3f615e2d6e232e9692619a4cd3991cf902535b9a848f1fa3fa5d1f9df9d6064d84a80c8b4b1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
183KB

MD5
b87bc892bc2ca2daedfe1d6e8543e917

SHA1
33782728e6edbb0ee015f618895362665cbdf939

SHA256
ba086776f3398347cba7e2a39674b059e6ed7c6ff572c4da4e310dd4ed35a3e4

SHA512
7375c43c60719e06fadc30c096754a8d8afa156c20991f0a53fd061804d8301d805f53623207c3ff50e41312499ce4d8c9ebe9d24821c8c8198983ba3b3f2f6f

Download Submit
memory/968-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/968-808-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download