d3dbb999bccabde02965215310c668fdf9eba38317dbbb631801291a5e41b77c

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ea4e957a902a6405c52a06b682f8f30N.exe
Size

58KB
MD5

3ea4e957a902a6405c52a06b682f8f30
SHA1

1931d2f18aeaad356837bb4a82139d56bcc28d81
SHA256

d3dbb999bccabde02965215310c668fdf9eba38317dbbb631801291a5e41b77c
SHA512

1b18e491ca0f4d15524c345beebcaba6952230e85ef8aee7263f6d9614e0be0f63dd325c51440cf06be37aa95bfae9ee14ed1ac732d88fa89658e7cb057e8ecf
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/T2wqv2/:W7ZppApBULcfpHLcfpX2/Nw/Nwmxk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4567) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ar.pak.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ea4e957a902a6405c52a06b682f8f30N.exe

C:\Users\Admin\AppData\Local\Temp\3ea4e957a902a6405c52a06b682f8f30N.exe
"C:\Users\Admin\AppData\Local\Temp\3ea4e957a902a6405c52a06b682f8f30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
58KB

MD5
ac03f18887a356f4b0e556d785b2ef1e

SHA1
affa18adb6caf87ad1462019cb8249b3f07a2283

SHA256
22ca0639b3d1c4e4b7c9dbc376dfbadf402ffee393d18833a681b33fe582b103

SHA512
dc86e00c21e7b045747de5a60b7e78a62bd8410eb73c399ed911b548dbe3e2f02425d5df67d4728cb9c1cdd11bbe93b08ab8bdbb18c08d232ad71c78981a4a1d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
157KB

MD5
046d60899bad2dc7158e0b0659674d8d

SHA1
7bca80f5e6d9abbc96c1d3f2b4ce3b0a69a43a89

SHA256
7861d9d9035d061be2ca6e985067522c371af17130b1d66571b480bdbe23f523

SHA512
59a993b21ca09c0de6e7ffbb5598e70eeeb858a7bc27738e03fbb4115d3537305bfc8d8fd2a0c1229378b8179b6020039784d676d4b98cccbd50ee901ace3f19

Download Submit