2c266a5d9aa6130222ec452ca032e97e3d81323d8d4f309077feeb96c93dd2bc

Analysis

max time kernel
119s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3900a357bb4a79d668f174e1a1bff7d0N.exe
Size

56KB
MD5

3900a357bb4a79d668f174e1a1bff7d0
SHA1

df872b79f2ce1b422016d3f75cf2266d93344ecd
SHA256

2c266a5d9aa6130222ec452ca032e97e3d81323d8d4f309077feeb96c93dd2bc
SHA512

b5f3e195e4ff8660813ccd67d310fbfd54dbb0c4b5903883925caff3c85980cae24e124929df4b80ca969fde97efd05960f2256f5260e44e5bf7253b7da4640c
SSDEEP

1536:/7ZQpApze+eJfFpsJOfFpsJMTE7o0Da0Dr:9QWpze+eJfFpsJOfFpsJJ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4078) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\id.pak.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	3900a357bb4a79d668f174e1a1bff7d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3900a357bb4a79d668f174e1a1bff7d0N.exe

C:\Users\Admin\AppData\Local\Temp\3900a357bb4a79d668f174e1a1bff7d0N.exe
"C:\Users\Admin\AppData\Local\Temp\3900a357bb4a79d668f174e1a1bff7d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
56KB

MD5
46046968dc1be13b46087c8492236364

SHA1
5f6c5dc122d23af339a09199a4a82188029b6257

SHA256
cd5f83dde8e5f784b1c926a0d93889993a4b917a3f25b1afb429b64b71d4e801

SHA512
7cfdcfc44f9d96251af0da53b2410fc4dfb0f1b6a8c9cc35927cfd2f8250378730c498dce29b5a8c19587259fdda5134495cd468e5224b90ecc6af7000aacfd9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
2330d089272ed2513ff9cbd533d166c3

SHA1
ed00793579f40e5c66088cf4ad36c661e59969ec

SHA256
65a30501a7ff84e7ab0fdb0067ca66a5949483c208c24e9366f10c75e1019fe3

SHA512
bdcfc73fe31bbbd6266eeb793d656366fa109c70147c50485a2552d7b77c86cc502624ba05186cc2a550b72d15d304b38c766b29e086ea171c447b0f354fb9ae

Download Submit
memory/3468-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3468-1622-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download