effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
Size

46KB
MD5

7a59f9a3072570d556e65159acc13e99
SHA1

15ef337e01a68aed7881f33d91d4a41b14390185
SHA256

effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8
SHA512

1ca010570d028023b3dd5501d983ee214808b67c5c01b9ea01b8907951503c09087c91ecbd0895cae1dc1f8511772f060af9431d1d22ed50879836b1606c530c
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBN10wpAp/lvolGClvolGwTCus7sczBtRrhBn8xzP+z:W7BlpppARFbhbt7Y7wTCnBbrBTrB1

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5196) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAB.TTF.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.boot.tree.dat.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hr.pak.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe

C:\Users\Admin\AppData\Local\Temp\effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe
"C:\Users\Admin\AppData\Local\Temp\effb138198caf4b497d1d1f03607a7d70e924ccd1b5af624edc3e0f64e1f53a8.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
46KB

MD5
def6d04731d91e12c38064e18904192a

SHA1
9d8299667538d8464df2b997e922a001e06d34ce

SHA256
0acb966051bf163bd73556b3eedc19a0f13c16aa6d508853fd6aa76f46cbaf77

SHA512
a8b88d48be656d23a389e4d89148cd8ae0f3752dd889bacc260a6de824704162133a8faa6a25c9076bce0708c25b3cc36db250febda7da162589fbdba73f2c2b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
ba26018c0238c4500e818e7767af87dc

SHA1
5fb3f5c9270763460bc77221e3fae779fb59c8bc

SHA256
a273c5db55448cc2957bff3274a7a8f284aca1001ff73580a9471e96a3a09461

SHA512
781bf5f4c0c91f77747e581373c3cf2167c25033f0b8f04ec291f3e47754ed8a22fa695217af178f707dbc4f58a2f8b248c2d1db0ddd5ef67e433eae1579113c

Download Submit