a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6

Analysis

max time kernel
150s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
Size

100KB
MD5

22fd8a43ef4dd397719684c8d13c1df8
SHA1

b80ed04107b8f40dc18103059e15de2458f0fcb1
SHA256

a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6
SHA512

376e21b738862045e2ed96eb11c2dadcc9a4df8c58b9d2f341a8fcf65a5b72e984507ec320595fcdd126fc1ddf8849e1e19ce0d238222d6345765074822e1bc6
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7fQ:RqKvb0CYJ973e+eKZOf7fQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1763) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\123.0.6312.105.manifest.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\icudtl.dat.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
File created	C:\Program Files\CheckpointClose.cab.tmp	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe

C:\Users\Admin\AppData\Local\Temp\a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe
"C:\Users\Admin\AppData\Local\Temp\a3976692034588a92095036c5d8038a7a29c6eb783cec53fa153fab0b25974b6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
100KB

MD5
2003decee304807629da9793adc11869

SHA1
166755c76b0a3d970071de993a68c0626bb4abed

SHA256
c926056c936c03e0554719d39c03cee05bc5b596b93e44a562781ddb03e75904

SHA512
d6aa60d3951db0b8412c81b4cad4b6f46322b7fc31399fa4403b9a062d0604fda22470cace531f0768f2225660690d746b98d2bd428fbbd8177d4e50f968c1a3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
199KB

MD5
951f579d187d7c5c7b40464527043480

SHA1
662afb437117b7ce90ece4f3edb30a24d202ad6b

SHA256
dbd55c574292ec1ba5e7f6b80bb1ec71aee2a4b7e114e3163706b659b7e18457

SHA512
d92dd8718a46cabae1f4e69db76538155fcebb2f7c2c192369e0582464b5afaa265e5711bdd19b4639495b625d41d63307ecc4eaefa793c75360777ebd85fd02

Download Submit