b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52

Analysis

max time kernel
150s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
Size

56KB
MD5

c1eac3c43e167ce32589afbc7823d7d3
SHA1

0da7e1db3a727f63c1affa0523c745e7a704b38a
SHA256

b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52
SHA512

718f3c94d83ac80339cf5261cd5489155fa32e251b5418eb044242a3203e8f4768ec516a63927d5ef9c61fb5e6418c9ab167434002619fb82a2f3b16bafc9f80
SSDEEP

384:GBt7Br5xjL9AgA71Fbhv7bhvo42L5FgAytBc:W7BlpppARFbhjbhg42Lcfc

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OIMG.DLL.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationTypes.resources.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe

C:\Users\Admin\AppData\Local\Temp\b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
"C:\Users\Admin\AppData\Local\Temp\b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
56KB

MD5
9818f39208b82949aa4f5642d5e82237

SHA1
7c135048cf13162da0581d0c4444089b217d79af

SHA256
e51b8663046e596bb366b9df82f6bdd1735323762881cbc38a6298446b55d7d2

SHA512
ff04529eaac8b400c6c64f0aa976759c32c0366af783eba997a5ece500ed9ca7cd5ef5d07583222e44b2809b07a4047fc63036e1778b4ceb8675408d3dbc1acd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
f6ee32f112f8c2cf6a9db8d16e835cc6

SHA1
4b60ebdddb13b1346af88a508765031b80cbec72

SHA256
92edb0fbe714491ed36b1841ee68db6a8b138c7f92cde499fd2437fc6b1a4eea

SHA512
041788ad2e5a5adde0750cc9eaca24ec53e3d23bea1ca5b87f35247c43c35292fde6ae46492891f70949886eadb7996fda99d62d815a79b4a4c3f066a639564b

Download Submit