ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492f

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
Size

49KB
MD5

7b0740c276685b6617c36a7e014b4ab0
SHA1

b0dc8930ecee697842b7c0749139e905ed4f57ff
SHA256

ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492f
SHA512

27422415ab44d7540535aade263b5425b6a210b804457246ccd75057b642108cc47c59296fe0a465f16b25936c74cd9d06e63a1f45dc363833d10603a660bee5
SSDEEP

768:W7BlphA7dASbSjJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c53J6XJ6M:W7ZhA7dABJJZENTBWv36hJ6XJ6M

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bg.pak.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\cs.pak.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe

C:\Users\Admin\AppData\Local\Temp\ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
"C:\Users\Admin\AppData\Local\Temp\ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
49KB

MD5
b471394b4a3a7657c774b37b73af5074

SHA1
39716404fe0629894147b5e215c1b28dead9dc10

SHA256
981f6dd15ea583197974187da30f45fb04fffca615397f5cf49b787111974bd0

SHA512
bd17b1d809c65062cfbbf4e63dfd4b4b1b3f95c17af394dffb8cae34d7b31ec90bfe00dcc6fdd91c04fc78a4ada6bbd20c399c56fb945174f668f1508adeccd5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
148KB

MD5
6264e88cac0158406298e57b6ba62447

SHA1
fea792791b05da1f396a3d58a30069c440f18281

SHA256
a0a4da4963e4d3f365360e02a802eead146ad5323d352b7d8aef5b1ed1bde794

SHA512
76a9b34156aa6fa0e9390156df4612f911e5363328cc1ac81d0970b3932bb2d320d37efc66c767eec9019864dccc513d51b2acbf43002968f83804d2c11dde47

Download Submit