d7d7150bdf08ff79e2368bf162bd0217993b3b8ae29e35dd539930a2199ce92c

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
Size

46KB
MD5

3f99f8185ddbfbcce70dcb4a3e0562b0
SHA1

3cedbc2219cd41bdb6c824e59bf5d4809372cdc6
SHA256

d7d7150bdf08ff79e2368bf162bd0217993b3b8ae29e35dd539930a2199ce92c
SHA512

3129ec047a23f9a0b35527dea8957047968f5584d265c85eb52541bc011bb45603360beae2aabf92144f56e4e5fe25e9eb2410a9c08d3ab399d52c82e5c887db
SSDEEP

384:GBt7Br5xjL9A7AgA71FbhvnIH2YsTKnKqtaW3WaEdW3WHYC:W7BlphA7pARFbhvOsTKnKqtkYC

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4366) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART10.BDR.tmp	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f99f8185ddbfbcce70dcb4a3e0562b0N.exe

C:\Users\Admin\AppData\Local\Temp\3f99f8185ddbfbcce70dcb4a3e0562b0N.exe
"C:\Users\Admin\AppData\Local\Temp\3f99f8185ddbfbcce70dcb4a3e0562b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
47KB

MD5
235ebc117e98b5aac628e7ce335192b4

SHA1
aba489b350d34b78a164e435a4df8a02c323d2b8

SHA256
3362c99f9891e3c8e11c6c3771e220229837e72a36e2e132a05fe1db06f7682b

SHA512
5c5249ca2ba40da7d26fdee22a4a944e44b1520ed2b9816bae96bd05fbe2da1c02badaddf6f7082f53027a4c68ff2e91729aea9e6bb683a13ab6aaf28cd425cc

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
6a38c63e43843c8a9c3e26bb6b0d46f4

SHA1
807dbec68a988d65f24b79d8cbe0e9208e28f678

SHA256
5bdf50dbc93471e7e71a3eef2a824e30762d7e1b50bd886dce54e05d810855ee

SHA512
a45eff00d1674ed18089ab6b3a132b87e3fcc59653ce96fa4bd49ce7f0ef339c1ef7282c31c17858b5e743f7bf3d659bfb085a4e99464eb9edd6ce6b99907572

Download Submit