3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210

Analysis

max time kernel
150s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
Size

68KB
MD5

47ffc4281b93d6dc3ee03e39aba3cad7
SHA1

60619295a056e318ba1b545c22e7053475240dad
SHA256

3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210
SHA512

f07f2c7417d962adfc0bbd7d1fae589db5f106f74c2fd2d7baa336c314f61b76b36d02f2db3b7fd872e8e367bafd334f459906f48c22326d9d39c09e1e7ff952
SSDEEP

1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8Ue+bS:Te76WQSotbS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5028) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\TellMeRuntime.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VCCORLIB140_APP.DLL.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VVIEWER.DLL.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jawt.lib.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\es.pak.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png.tmp	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe

C:\Users\Admin\AppData\Local\Temp\3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe
"C:\Users\Admin\AppData\Local\Temp\3d9b7fd232431d8dfc33ae089acb548794706c21d4e5a9e803eb05f40648e210.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
68KB

MD5
6e24f983e3b054921883b93516b58c92

SHA1
1a61c77943531d153b68d2c9bcbf2aceb90c9fc0

SHA256
44a0023b7c7fb921a9d5f768389358a1edf1fa0d493a687c972dd2b1d00ba027

SHA512
29ff2acf22a578a2ace5bccb3fbb06b3336d94b521dd2c79ddf5fa2840556d47d50031d8e06fff34410d892d2d3e5b679fe736601de3dfcdae4182e505aa5fe4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
167KB

MD5
4ba0c67d778a5bd25f9ee7779085d935

SHA1
cbe7684f1c81bad95c37c58c1a26a434ab575693

SHA256
8bfe47587d4dcf89160c15ebd23fca9645361d86c45baab0459d7609c45eba11

SHA512
5428daffb00f7d107a51885f4bf2786f92b5b6662ecc1fa50c24aa28b6eed62337d538b17421d9d4e91d2906f15601c6b958b253a4725d70a9b9a73d04d86d69

Download Submit