5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
Size

55KB
MD5

ffa8b66f8c550173b920d5657d538f40
SHA1

922de8387eb272ac6232429b09ab85f1f44eb056
SHA256

5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5
SHA512

3010de950b44f6dda845b7a1d918d58d6f0cee4ec17514a77ce27229b1f5932f93c43564c04c1df18aac0b7e4f077e5a5d77848ec9c23261dd988be6031c9bd4
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFkTfq9Tfq7h6hWh2hQ:W7ZppApBULcfpHLcfpyDc2ih6hWh2hQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4650) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\eventlog_provider.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe

C:\Users\Admin\AppData\Local\Temp\5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
"C:\Users\Admin\AppData\Local\Temp\5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
55KB

MD5
3626460b4b5ec76fb47bf90f574f7880

SHA1
e90b6e9c5965c96b7a2e78d7ca76b1d1b7d54cc5

SHA256
dd2913be87eb052f79bee29d3451d02da6642541aeb4a8cf9367a2b4d9b1b08c

SHA512
2149caa8a3f1e72301a8cfda47e2be68dbe65b2312c53375421ee92003f4928b08fa15153b7eb2046db5362c75b348341b269c806f289b56234249012ea1f46c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
154KB

MD5
ad06b63d8bf0d03b59b9fa4d748fe51e

SHA1
4988176662015fb372725ff6c3eedb023d84b170

SHA256
598d4466652ff3f13319daa29383244b9919aab9068698b49a5fba07e7eb497f

SHA512
ef351f4e1f47ea86a4e8c52a16f590986ad687cd69ae4496e1110c990597bba6bcbf874de5f715f8b2ef3c37dac1ac68bcbaae10805f5f41191c7654cb3629a1

Download Submit