Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 02:43
Static task
static1
Behavioral task
behavioral1
Sample
c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe
Resource
win10v2004-20241007-en
General
-
Target
c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe
-
Size
100KB
-
MD5
3bde4a3622baaafde0a9a99f5cb86421
-
SHA1
accbfb53a30afaa1f4948f47ba365dc2c5070af5
-
SHA256
c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca
-
SHA512
498074b477841f824dd9a37f8225d4fad8eb0b093ff992e72e1446953eafca4a7748589a694842611bdcfa829cfc415e42eddee563d9cba638552517350ce121
-
SSDEEP
1536:W7ZppApsJNg0tdlAX+zq852d1F4V+kw2tJKSh2hKjEkjEZ:6pWpkuK4+bE1F4c2r4k4Z
Malware Config
Signatures
-
Renames multiple (4866) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exedescription ioc process File created C:\Program Files\7-Zip\Lang\he.txt.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Internet Explorer\hmmapi.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\ExpandSync.pps.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe"C:\Users\Admin\AppData\Local\Temp\c2e1d08dddb3d7e27c9252d2d236d6ab7df24ea2f6d6894ade9f93a530627dca.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD55d3d4133d0121a2ba8d7837a6c438e91
SHA1b75b9f028acf80d32b2d08e708a195132d5b3197
SHA256a1b679a1961b10e8c711e7e3c5341add6ed1c37be9ed4e49a0bd6226a38859f9
SHA51231e867fa65ced7a71c00452992a49c1e83b6ba2cd324a571d4061655cf2c8891cd3846db7e376443e0643391c2d0365a74194e17b8cea264fe3e57fc9da37a23
-
Filesize
199KB
MD5945f0ff513f9f7809d8f4fc76846030a
SHA15964871135950ad916df203ea2047e006750b02d
SHA2562347d572a65b4d4d309011636550d885ef4fae483dbb05b034f2e8be2e5439ff
SHA512a1f800860ec769d044d33aa1575a6f14e0884534b9f9c16744e871b3c2c8f65ee5f7f4ec4ddde8ed0458ab65eb9323f04f7c90b05ddcbae967d893f6b4a7a3dd