00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
Size

42KB
MD5

06e258a99258e4c6d3b1136dd8501170
SHA1

65dc09d3559c9157132785c2be3603d4eb6b8005
SHA256

00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889
SHA512

b8564a73f08eba272fe56cbea5f4158fc62a991c417cd92eb4a12387ed8358394cbe1e6a511ed63baeab295a5a3cafa1c9ebe299306ecddeddc7104b5a5b908a
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltNChyf7maVF5sQXThyaqzjxwFChyq:W7ZhA7pApM21LOA1LOl6ANChyf7maVFg

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4647) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Xml.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-CN.pak.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vulkan-1.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe

C:\Users\Admin\AppData\Local\Temp\00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe
"C:\Users\Admin\AppData\Local\Temp\00e55c943f7593caab591395a343057703630c5f6f978d5924b537e967d2b889N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
42KB

MD5
43d73dc2ea7191b39b019a2f974fbce0

SHA1
5fc0c6df0e91df9b955c23b00850f52b82bd8eb7

SHA256
84214e696f5dceb3364428c29f62e1683ca0b00108b74de7b2b36337bc3507cd

SHA512
8334111216e8e969b1a0034c6a6a8a1190a89663a758dedd6aeeed67ce272ecf75718e19227b4bf4984f715f229efd6b92b439dbe0a58fa8897d3f8f61ae35f7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
5429cac4e13f20df7c36dac7690d1b02

SHA1
66b3abcc53cf752bfc81e9d4ed2c902faca9cd2e

SHA256
c6bd5be2ceb301af516a7af237d0959b71bd704e8e713e3d77d90dfc55adddd8

SHA512
7e330484e436e1e9160b15e8accfecb80b66e6e3b5be5a4f8d7b5955191c0a2ab9916abe750e712e842ca9eaaab546e0cf12fbe8c1085b0519ef22e72fbc8427

Download Submit