af3cf69af4fac9f6d41c8dfcce3de9bca9f98cf0c4b384ea057ce77026eaee9e

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

336eeda04cf8435f061200c07c493e80N.exe
Size

75KB
MD5

336eeda04cf8435f061200c07c493e80
SHA1

d9c106d4452504db915021172c444ea5aff74d71
SHA256

af3cf69af4fac9f6d41c8dfcce3de9bca9f98cf0c4b384ea057ce77026eaee9e
SHA512

1701a3c9925cbed4721e85e96f6762a0a8091d6fc4f2a2e7825d1700fc18a5b6a7e20213f9bbcdef5a588341e99a19ee7037e1825aba71aae6ff59a8c2b10fc5
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7YNNdNpyI8yI+:6e7WpMaxeb0CYJ97lEYNR7kzlS+

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4666) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\th.pak.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\blacklisted.certs.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\JoinStart.search-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NetworkInformation.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	336eeda04cf8435f061200c07c493e80N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	336eeda04cf8435f061200c07c493e80N.exe

C:\Users\Admin\AppData\Local\Temp\336eeda04cf8435f061200c07c493e80N.exe
"C:\Users\Admin\AppData\Local\Temp\336eeda04cf8435f061200c07c493e80N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
75KB

MD5
d787ab643ebe06b179d5311be7e9ce63

SHA1
47a93aea9ba4a434a5a483077dc3733afa6b3b35

SHA256
f0d79fec1cfa618b9b460bd40b3812cf84b34c3aca6934fea73fa1932edea39b

SHA512
0dabc5d6c04abd50e7073bb95069b913cce5a84c491f6fbcdd2954437d4cf18b8e36595a2c040c3ce8bdc3906c7f3a32b0eb1aed2a4d749570f4c0c54b0189e4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
174KB

MD5
4498fbb5aa6d44947068416efd37692d

SHA1
a7118c3e5bfb32d25d185be6e981a4d66905a709

SHA256
766100c8409eb31a9e10b10815f79245e7b66844d0cbf89ea82805a1fcf0d59a

SHA512
7d4ea0fb3c91c3e1a90f2825f3caa34d7dd61d9bb2a316e6bca905926a1719af16732c67504541af26c8a81194cb601606e14a1e31ce541de2d9de2aaa68a89f

Download Submit