e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 03:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
Size

51KB
MD5

8bad9f43cf8e5096fc32b51b654fcdc0
SHA1

b017936a5ca256363d0839858de546fb34edb56c
SHA256

e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7
SHA512

dc4499276170c254763d97b4dd2e9988723821966bf304ce19da095b829cc57f23b5664c60b773e5087b4afff0e58910cac2587e9557d9a03d2d0250647d3f20
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lz/g6sHzcXHzcC3OTHTKwJ:W7ZhA7pApM21LOA1LOl6l6YzqzV33wJ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5186) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\EssentialLetter.dotx.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-PT.pak.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\bundle.js.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\preloaded_data.pb.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe

C:\Users\Admin\AppData\Local\Temp\e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe
"C:\Users\Admin\AppData\Local\Temp\e89e9083b960689d748af36cccf97651b7b45a9fd109fa613c94aee8b3c138e7N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
52KB

MD5
3b0237091d83e314959c41633b10f561

SHA1
e4f02de8c1d723a1471354396e1f9afc833f6843

SHA256
1e263bc81f5cd7e172e7eef0688a22bbc3e7540b57e2c33a4753c90f46e6f331

SHA512
a3767b8bd70970deb10cd184903fc9753bef28d50fb6098ba6b39d11defad6f5d9d1a3c3051a79b76f70d21968ae4c0da7d3e5803ba86a92fa9ef8abd339811a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
5ae2ad220ad33db920d6e1b5f50fcc98

SHA1
4d4f3dc243b2c903fef819753e11ac6c66f6a104

SHA256
0776582c61512ce0d9810eb3ff2a3601305435f78fbb89039015a47f0573455a

SHA512
c6845aaf0d5b08ce95a49ddd1db24484e56144219559f1e1ff8855b612c6da5c545ba54ae980a91bad2fe177c177907791ac9fe9395bf31918af44f8bc215cd3

Download Submit