0016f385395b9da566997851ca1c4b6944d633a9279fccce9e062057be5b7821

Analysis

max time kernel
120s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28-07-2024 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3221864ea83f81cc1bc8b36b080de000N.exe
Size

50KB
MD5

3221864ea83f81cc1bc8b36b080de000
SHA1

46215e598cc2ec1250fd776970d9d34cc5d016ae
SHA256

0016f385395b9da566997851ca1c4b6944d633a9279fccce9e062057be5b7821
SHA512

d25846db4608572c6d8d5b56f7a91d230d068c2d297faa425bd95761b2d201e809c7c77bf9cf1131b50f507bdcf671512beabe2f5c3f2bd6540a36431a63fdbb
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPqAlJIqAlJVUrn5c5hU:/7ZQpApze+eMUL67U

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1791) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome.dll.sig.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	3221864ea83f81cc1bc8b36b080de000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	3221864ea83f81cc1bc8b36b080de000N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3221864ea83f81cc1bc8b36b080de000N.exe

C:\Users\Admin\AppData\Local\Temp\3221864ea83f81cc1bc8b36b080de000N.exe
"C:\Users\Admin\AppData\Local\Temp\3221864ea83f81cc1bc8b36b080de000N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-384068567-2943195810-3631207890-1000\desktop.ini.tmp

Filesize
51KB

MD5
461ca1b32951d818b6f2b019706ad67c

SHA1
653325e4946484f25f81a206420a090280a71296

SHA256
83d00ed05d1c0c627502a8b7df359846cf15ef2477fc3c72e77b10282682d097

SHA512
1a8eb498b7248d7e59b1327a486209a402517af96615985e68b6c1e1b0404b3a68d631e37b3fdcf426cfa98ba28655e50c58fe0f8b5c150c8ab8518db38d6bc3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
39c98ea33129c8597d20cf53d9358b88

SHA1
06fcf5ad357b246045edcbe9d6043cf288742abb

SHA256
0f9da111487ac0ac681a8e0830c0c3a758b85045bbbbfc9249fe02119f21ca6b

SHA512
ae72f5f10d302b695798890244a40a4e3bb212ced67f441f3c072a1a072c7b660a727d9f834419a831c2bd71a1601108274016f718dfef06332934fcdffe73ab

Download Submit
memory/4092-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4092-1186-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download