Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240730-en - resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system - submitted
02/08/2024, 01:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36e3544f096b499dfa8cfe07981788c0N.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
36e3544f096b499dfa8cfe07981788c0N.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target 36e3544f096b499dfa8cfe07981788c0N.exe
- Size 49KB
- Sample240802-b8rsnaycql
- SHA256 c2bf07f39c8822de912d20ab7b078e8e1baeca5d96beeae9135a30c7ddb0f0e1
- MD5 36e3544f096b499dfa8cfe07981788c0
- SHA1 5441c05e01a1f912ec3750e77fc3625313397006
- SHA512 5a4f4d8b6560879e7dba33d67b0b93e927a5510ab9fc48a8a58a799ef29fa5597df0af7f4cde4042e6c74b322efa8640a5cd0e41e84ca6e6d5048a20c91de52d
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBN10wpAp/lvolGClvolGwyPhlqbNJyPhlqbNAJSOwA:W7BlpppARFbhbt7Y7zPhwyPhwdOwOxVd
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4641) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ko.pak.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp 36e3544f096b499dfa8cfe07981788c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp 36e3544f096b499dfa8cfe07981788c0N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36e3544f096b499dfa8cfe07981788c0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2927035347-1736702767-189270196-1000\desktop.ini.tmp
- Size 49KB
- SHA256 ffd7815092b0d9e74b844d15d7c512af2ba951cc8069a0359af04817dd4b4c07
- MD5 c2610578df32372341beb3d77dc41b7d
- SHA1 8944dcfbd5f58887252e16a2fb817abe36eb0a5d
- SHA512 fdf70a5ec581e2fb7909574c2360561aeb4d836a5c05e876b7f5dff9974c7818fcd96d332c5af1baec9d504e3211048023a528895d60fb513ebaf0d114992724
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBN10wpAp/lvolGClvolGwyPhlqbNJyPhlqbNAJSOwj:W7BlpppARFbhbt7Y7zPhwyPhwdOwOxVC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 148KB
- SHA256 1ab2e5b17f7ca6ffacaacf42b0558b97dae1928f9ef029e82157421a0b7c7f73
- MD5 0444b5a95594d4573ea25bbc7b565297
- SHA1 3d92674d17ab9ba06dd03257f8b6654c93f54d70
- SHA512 a51700a8ea15ccc630cea0ae703ade9a9643921cc70f09a0ffd1bfb4a1f8a36ff663ee9000bc29f1c9045a434e871a55eb11118049812b31253d394e61d821c6
- SSDEEP 1536:W7ZppApIayas4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4DV:6pWpIaya/WHIjN3tj6qnv0b2UrXkbvLx
- MD5 SHA1 SHA512 SSDEEP