33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 20:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
Size

297KB
MD5

b439810f6d2fe7796bc124edc3bc84ec
SHA1

32314523f25e9dbd069f8b3acf88452b27778d28
SHA256

33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a
SHA512

43194e2d13a7dfa78aad0c8afbb4982aadfa3b89b13a97e7f6e24f97ca3bb7ba1fc9f27e6f2dc8af77ee633c2d644d39699c20825ed6f440703e61065c1a6950
SSDEEP

1536:W7ZhA7pApaX0aX09rDVMFDwU5LenTpnDr5LenTpnDRSfuYa3bztYtzZrZotYtz1H:6e7WpGlCK1I1H

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3984) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Java\jre-1.8\lib\currency.data.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe

C:\Users\Admin\AppData\Local\Temp\33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
"C:\Users\Admin\AppData\Local\Temp\33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-384068567-2943195810-3631207890-1000\desktop.ini.tmp

Filesize
298KB

MD5
2453d6e1278744dff8c799f6aa796f0d

SHA1
6ab0e67f159aa013088238036031c183f07e9994

SHA256
dcf119bb16b99901484ca18febbe83ca05d7b3c1ce22fbaa40b7451f5d9a8a3f

SHA512
30c871cd039a01d2f143b53a72b4ec43364bd11f7e7aea4a060c723378f568aa7a7dcc76dcda3ea2ba0f907f2a226abb11f24c0ac88a2862aea1818d07f2cde5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
396KB

MD5
9dccd5db3cae661919a91fd617cf0ae2

SHA1
b0ef93a9af6a46c34767038e0c69bdf95ffa6e14

SHA256
1359cffebf753c536e95abe39601d0f0b29d74ce3f904e3d1329d97cee87ec24

SHA512
ebff0ef6339f2f63390e4ac504fd8a9efb24e7730fa3f5341f83a2489425d76a868ed0a3699183605c636b78650a4a8889f238056c349fc4b31b5529e1d107e5

Download Submit