e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
Size

43KB
MD5

854e354f85ce92cc623c4de1c2239240
SHA1

756c1b3f2cb9c3c84e1307c54561c630802dc4cd
SHA256

e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2
SHA512

93ccb3a9fedb6138673142f449d989b03bbea507f78dd206977a5d98fe68e7f5e795f66c79057ef1ac506f67add05c48e8548ca7144fd2fe54402f7eb9ff3d82
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNF2B5dB5y:W7ZppApBULcfpHLcfpyD2jdjy

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4670) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ca.pak.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe

C:\Users\Admin\AppData\Local\Temp\e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe
"C:\Users\Admin\AppData\Local\Temp\e6ce1548be3959ca8d55269aa7b7ccd52d2b258ab389adc74c602125f165a8a2N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
44KB

MD5
49b39520926c798e046ab11395134651

SHA1
6fa10f4b65c36bdf091a34ab1dcd04341f5fbea9

SHA256
c16e8c8ed4d88e110b03a33326406e723cc725b57cd887aa1fee7e57d7fb73cb

SHA512
2e2effbdd2da79e7cba0a2606ab23e9b8e9cb60a64e0abf01c6f7cfb906f8bfc9c4f63ca04c9ee32e83c4dcce7205ef1b2d770371266d386f497d5338de1ae3a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
ea98929da63f42e546ef0f1c07bdfb1b

SHA1
966065067b45158c192363f2779ad1c3ef9601ea

SHA256
e52744e7163fcb6730caf812b4bcbb58d2c41c166cc063edd432b829b71308f3

SHA512
f1603b35ccf0843a0457a09758a6402d30d23c70a44d3c3fc3072c5e5a4d3260c45ff3744a8bd9c554c7827eb8a7deb2398b8f5e0801cb5c5241d33990d828d9

Download Submit