e9350d4a40a5945b1808ff769ec3962946d664d56d7ca237f9090de454ec9edb

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c3231f48eb034bc4aeede64d8c4d6d0N.exe
Size

53KB
MD5

0c3231f48eb034bc4aeede64d8c4d6d0
SHA1

cfc17d9eabca136f3b24cfd7a5aaa2fe5b347037
SHA256

e9350d4a40a5945b1808ff769ec3962946d664d56d7ca237f9090de454ec9edb
SHA512

8fb39f3bfb8117932d8d590deda2c95fea85a43a66ff7dffa009e5bd39060efd6f91a11fc1e5a391c71bea6864f60a25992beedbe426dc2d96fb7b90320ebb95
SSDEEP

384:GBt7Br5xjL9A7AgA71Fbhvyu7uGYSinVtYSinVwb1W3WxV:W7BlphA7pARFbhpYSiHYSi+V

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4656) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-oob.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hi.pak.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-pl.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\DebugExpand.php.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub.tmp	0c3231f48eb034bc4aeede64d8c4d6d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c3231f48eb034bc4aeede64d8c4d6d0N.exe

C:\Users\Admin\AppData\Local\Temp\0c3231f48eb034bc4aeede64d8c4d6d0N.exe
"C:\Users\Admin\AppData\Local\Temp\0c3231f48eb034bc4aeede64d8c4d6d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
54KB

MD5
a0e79be12c0e29d30467d17ac168884d

SHA1
b9651c49da1315bdce87ede098ad362e896ab13e

SHA256
f445dba2421d0ac637c0da47ac749731b91a22d24c3e36977fbb6975d727ab54

SHA512
9fa5fae101a5013fde9d3f24644bccee8ca9bfd8c03efecddb0215432545753ca1ff595d7774e3ee9b0d8b819738b6f9ff4aa8fbd208dd98b1a04c8da30914ef

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
23baf88a862fb50c39405e996b87d218

SHA1
84e8e509793bd926f5ba27c2e86a15b039f0850c

SHA256
2289181f20c83122a33f9d6073d5a599297559979d1b2a6b0ab6db7f204285cf

SHA512
63e7470f56b9bd2cfce9b58020334f0ddd9ecef246c7ef39fe6465f04f66122fce4671403fec5e9d59e5a874d347f11470f3d41ee7542ae53dc59693c60af6ad

Download Submit