3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
Size

43KB
MD5

58e528f9ea5d816bf04a238035aec5f8
SHA1

8d155f8d4f59e794e1aef454f76b2f5c15e93503
SHA256

3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d
SHA512

a1464e5fbf9b2e07f0319a13b057a037d9d87ca4f0ee4fc020754638c978d37351ce0523a57dc304df122dc2cb957bba9ba5ead51280bd40faee440dcfc6b399
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F11liKliB:W7ZppApBULcfpHLcfpSo3fO

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5244) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.boot.tree.dat.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-xstate-l2-1-0.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe

C:\Users\Admin\AppData\Local\Temp\3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe
"C:\Users\Admin\AppData\Local\Temp\3b584d99dc808129d140dbcbcf033529a0fc6e466c2dd1de2995e78c69fed69d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
43KB

MD5
08286e7f5b9e0a4c55043804163351ed

SHA1
d9812c3bf5a6f179351c7bc0243dac0fda8e71e9

SHA256
d6a8c6139906d945b27ead0e999ae25541b3add99583064b3f27572f5268d54a

SHA512
0363dd5338b951e6259487a28897f0aad3ef289b1e1fe60dd42ad5342d21f6196d8130acdfd9c4fb9de891b1dbba5eed840d4f5041eff206738ad9e6a75ed19d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
8631e8527a38f1f712ac64b64e1abce5

SHA1
4fc1b33573a030d29723371d92dcdf206ec66d4e

SHA256
d24b13899fc98e8df0674af1930276ba49baac4abde05ee3e388a9b9d5044ac0

SHA512
258fcf5635ab30b7a01dd50ad72e59c538c372cfe28f9a7c94a708f3bf764201628164707cf48efed38e5e68a78aaeef675e0cde4db7507f18cc0a248a5754ba

Download Submit