3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
Size

34KB
MD5

b55b75c93602efb09d483d83cab530ae
SHA1

a37927d9480d264e1c80532d0b534cbfc0bb0ab4
SHA256

3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f
SHA512

70e5e7485f2c6acbea24659872ba3df0acd2070a66564d1ac435af31d6a497803eb962acef96e6866cd90a9ac81a99c070ae663b18c3c2a6e0d28f3abca17e5b
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHhpq5vf:yBs7Br5xjL8AgA71FbhvsKvf

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5334) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp64.msi.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BSSYM7.TTF.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-MEDIUM.TTF.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-LIGHT.TTF.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAI.TTF.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\EnableSync.au3.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\QuizShow.potx.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONMAIN.DLL.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALN.TTF.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe

C:\Users\Admin\AppData\Local\Temp\3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
"C:\Users\Admin\AppData\Local\Temp\3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
35KB

MD5
9db8a09c1e39f5854860556420f70719

SHA1
d801e0e7f52b753bc50d63c00d75a01150aeaf65

SHA256
1e13ed76c3ad2f8540d924b6c9b836d9f0da30bc972c5d9ac8e304a8ce239edf

SHA512
c701f06ce11e8e1d02c1c885fe6a677c402f3ffaf0c66717eba6f9e009f274a3e0cae67cdca60604cf61564f64e00f0a84229f09ca35287bc5efdf368fba926c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
134KB

MD5
2734d449556c35a962a0a16e11231a4b

SHA1
7ad04428c86fe58b91f0c05a1fa2d6a079429784

SHA256
b401bd0e8f0a4cac0d29e0eda1c1b33aaf6247ee3a3cb5b159f37ad168db3760

SHA512
4c58b3ec840c437adc0a748be58606b895eaebe23d63c704c4ed4e3827c639ece730872b517c791ee9cdf1ce27410757c167e9b05f04b55cb07995a93800cdde

Download Submit
memory/936-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/936-1984-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download