c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
Size

47KB
MD5

43f1315621bff3c8cd5a336be705094c
SHA1

dd62be2510d39a11c22d85ec5153f44f4f62bd2e
SHA256

c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0
SHA512

cb15ee55f84a6cc93249fb0751972877f3b46e8b4af83763dc0219c906416246aad4f3d4ff2f1b883b55db64d5fdcd9d09404287e506d0c3a821f671951b9b4f
SSDEEP

384:yBs7Br5xjL8AgA71FbhvBfepj3cfepj3KtLJr4S04SCzwzv:/7BlpQpARFbhq1KX101GIv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es.pak.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BKANT.TTF.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\af.pak.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8en.dub.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MTEXTRA.TTF.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe

C:\Users\Admin\AppData\Local\Temp\c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe
"C:\Users\Admin\AppData\Local\Temp\c33b80e15a663a809e2fe8df00bce4c47e49b8eed2d2f3b1d563178afb8128e0.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
48KB

MD5
b0a4f8d0fae3843aef3346a6a771f8f6

SHA1
f0f3fd39a96a3ecece4fe2b35c48dc2ce49e1462

SHA256
33f33368a08c015653c68fa7e7b6709ab220e502229ed71b36010a2f5db8d3ff

SHA512
ba5018229d79ef4c29350e700efbb9a80f91d4956f2714c7f61c9d3f4df56639a6674078443d7e8f69a6e5cef81151c96cf8dd05285ade707bde6f23cb8afa24

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
88569c59712397c8ee07b3207e197a2a

SHA1
ba02781e41af0911569b58e4dfbdc828894766d3

SHA256
936bb4358517b07f0d80a132d727837d9121cb0e4f7e23df71989404bbff9eda

SHA512
fa78fb368d8890ff962817ef1730d3c2544592d8c944a676ab252802603143fffa8d9b35815eb5952d7440ed28ad7cf9922d90d8366dd1c96dcafd7c50eb7f40

Download Submit
memory/4868-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4868-1978-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download