e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7d

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
Size

44KB
MD5

b965ebc8baab3dc22ffec8ccdbe63f60
SHA1

9010020f4d20eb12f71ff5f3350449d58d16c4d8
SHA256

e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7d
SHA512

5c46ca3e553dc3b68fbc9e34c4b85e8f9a3e16242e28b72c2a92283cb300fa12aa6d194551a4b4bc20e2c322b4fb546a31a491cbe613a431c5b971cf3437ece2
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c5gSuK:W7ZhA7pApM21LOA1LOrtkpt6H

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4656) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.dll.sig.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es.pak.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOCR.DLL.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe

C:\Users\Admin\AppData\Local\Temp\e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe
"C:\Users\Admin\AppData\Local\Temp\e1d5880e20a74a6e148bd2f42e866a4d8d339fe93103fc7305709b4d5b404f7dN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
44KB

MD5
923724039d77b3124c31e012ea0d384c

SHA1
424c132f80dd51d913a7d6ffe291487d7c5cdd6d

SHA256
2c66bb7b4e62ab2cacd80c07ddb8a01161c10e3a7cbef38c766ae3d9fb4ddea0

SHA512
05ac7b6591f6353fc2f76745057843f27f5b7b6ba56854b3200a3707b9c3ec2788c67ab91d8e8baa1f948345124b16d8a88869f7c91840685866e6640a827a66

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
c0d3638c099aa63839fe54bd305ea786

SHA1
4202c44b8f5ed68d2ee50ce7b7e3d0e96f698887

SHA256
44946d52abd5fd4aa635f506386a4eb889cc8a78931e9e8279829a2626bf78c7

SHA512
5121f530ba185820e3aaaa32ed987786a4f95477272398858756617c4442727478c85c66caeaaa8d67d7dbc2b8aba49a0bd3cf4c40f8c832b5beb002bf738bad

Download Submit