ecc46385dae275a92f4678377288e4dd2d3cea124a354f1a7b0c17690a037640

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 09:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f5eb10e421380c814cea9ce612e10610N.exe
Size

76KB
MD5

f5eb10e421380c814cea9ce612e10610
SHA1

b13caaa9ed903015b9fe0f6a34693cb45541d875
SHA256

ecc46385dae275a92f4678377288e4dd2d3cea124a354f1a7b0c17690a037640
SHA512

0d818b343ec8cad4d32ac1de8cf55b3a579ed11b1d97c79f9586e76d396f585dfaa38d336f5f0319448e310efc1629bc18268ac25e043d6aa68b85aff8099f75
SSDEEP

1536:W7ZppApwEwnmJARJAaXxXNJdkCKPuJdkCKP2:6pWpUnDXxXl

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4646) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-PT.pak.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\FindUpdate.3gp.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\LockCopy.001.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5eb10e421380c814cea9ce612e10610N.exe

C:\Users\Admin\AppData\Local\Temp\f5eb10e421380c814cea9ce612e10610N.exe
"C:\Users\Admin\AppData\Local\Temp\f5eb10e421380c814cea9ce612e10610N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
77KB

MD5
6483513cd17d671ad03fad561520f87d

SHA1
256f3e3eb4b98d012e451d74824fb22b7232253c

SHA256
4b4d0ea3b5436d2f9d73078b8abbd28cee3ada885d612aa3c029a257a0658430

SHA512
31a01eda3cdff7b107c615ed1ac6c5b5a737563e7ba6df7a454c55eca67775abb3bdd203ca2a94e133d72a5e2508925c04f406bffef3431a7a6c04027f4d9e4c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
175KB

MD5
af84bc3263feba2ea04d112d32675bac

SHA1
8d36ab903223223b3a16f38cb07bff0962ac62bc

SHA256
f4fff404970e93cf3215edfb6bd2d47b377f7d527bfae66a7db3db1fcb6ba458

SHA512
70752a9392573c8ab1ab3d243d5fd1e6dfe1c25862be5375e17b7a7926932923340c090a44b25966f4e3b6c4d282e9473a18ce20be346b04efe5c2be41d81c35

Download Submit