815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
Size

63KB
MD5

5aee855eba8096c759a0d4ce318ba640
SHA1

8e9e020210867ec90c1247c1600c5cf7a13ea8a0
SHA256

815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678
SHA512

6a9e8d13e3745c17209e9d2e8a4fa170f7d18a3aa68f4a495840c3ac2ef7c24f81550e93ebe1e36cc303dfe2bc84492726e740f76c27516104426c18cda0c180
SSDEEP

1536:W7ZhA7pApw03vR03vcltdtSsU8Tu8Tmwzwycp:6e7WpwYRYUtdtSsBcycp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4617) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe

C:\Users\Admin\AppData\Local\Temp\815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
"C:\Users\Admin\AppData\Local\Temp\815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
63KB

MD5
0ec143ec666489dc1c23db7728e9f51f

SHA1
2700355926e21bcf642fca379dfe17187eb130ed

SHA256
39729cfaf3dc7e014e2235091912af0dd02def22a82156565cf68e4f497a4ed9

SHA512
2a64a6b5d6de39c1dd5f87367f9885d4de28283ec576f4e269a43455f732c83cb983c120d27b99450449c75e0af7ec0e4b979f0b271847be2e8d01b80a2f119f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
162KB

MD5
92d4953641961db4490f4796160ea6f4

SHA1
20645a3e56f9cd92fc2b3d0a5b4f19a4b2c622dc

SHA256
a3681778a6b7b86b39aafb6cb0f6a58ee9e408586399f296b3d8a86b84b5bdf6

SHA512
202e86b47ca44a8585eb1090ae589a722de1dd034d8d0a07e9427429fe8b9c911c0d7ddf66caf8bd0b873bf6487be9e4363518c5916bb038b7866b617f552d26

Download Submit