ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
Size

43KB
MD5

dff1f52790f116a7076182356e965990
SHA1

e14864accab10859e181e587a1e540a76f2356f6
SHA256

ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713
SHA512

8924fe5b8ed99a41b9531c8f8b5718af11aea570caf480c12747c4f4f1250f8ca9ee590571231dce19f0c1614a85e3bd723d9d94b916c2463a0f652e63edd91a
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c5qrVfZfKZF:W7ZhA7pApM21LOA1LOrtkpt6Ure

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5240) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.LEX.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalResume.dotx.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\optimization_guide_internal.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.dll.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe

C:\Users\Admin\AppData\Local\Temp\ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe
"C:\Users\Admin\AppData\Local\Temp\ee3548e210abc8fcb76b4e0e0bd92cdc449935ac82badcc1b37370e333e56713.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
43KB

MD5
3cb68b142b9730aae22e4f4449d232de

SHA1
8c02f7dfc77a647ff9687807fae63d3ee8d4a2b5

SHA256
cbd9986c6b3cf33535463e2c12be2538973e10dd17fd4c68d9673861f61ed371

SHA512
4c863dcc1473664434f24a8b26b07a24d230642ca5ed62e820f6f5b7943aef5ebeadb6baf560989e83d2dcd04edfb26617832088a4c6ef7ede0fcb605b5c3e3a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
142KB

MD5
bb34ecc0548bdefe3fc80802d9de9d9b

SHA1
fe2945e1a6456930a0b34c6d72e23f1e4342b0a2

SHA256
98000ec6cba19e8e45f02c2dfb770737475a10a217dd7a19b83d19131c5bf980

SHA512
fd2a70397eac3b6814a08aca342577b197ecf8f7ec0a03db1b90eecf4ba4b529a55bd06481e46728677efa1ff5f4dd495b5fa03589e2068b850c9cfb373bce7a

Download Submit