e8a2afa156977c056f2ea6f6f736405e0f135c8f7c181acbf2d8cd23ce87e308

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3b911112f0961989b22cfc6a9ba9c20N.exe
Size

66KB
MD5

a3b911112f0961989b22cfc6a9ba9c20
SHA1

40d4dda40b4a2355cb49d93c4a312c3a98c8ad95
SHA256

e8a2afa156977c056f2ea6f6f736405e0f135c8f7c181acbf2d8cd23ce87e308
SHA512

c6d53b0aa770467421fb30e34a9227bd8b94a8fa36de7728a2bb9a3ec482cdd12f2bfe585966dfcd616f19ad8c387fcd949e69f852ccc85f7a8a47724c368b24
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/U:W7ZppApBULcfpHLcfpX2/Nw/Nwmx/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4377) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Common.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sl.pak.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3b911112f0961989b22cfc6a9ba9c20N.exe

C:\Users\Admin\AppData\Local\Temp\a3b911112f0961989b22cfc6a9ba9c20N.exe
"C:\Users\Admin\AppData\Local\Temp\a3b911112f0961989b22cfc6a9ba9c20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2708,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
66KB

MD5
5b19a313fce12f0c1f4585815d9a3d0f

SHA1
68bd1ba72481c585dfc906357871bb12cae7a642

SHA256
ad0f618a20eb6443a900a84be9a46f02dcd1e04307dd8faaf1883fb5a08c02d2

SHA512
4d8e0ea5016f779723281c75b4a49cfc6f68edabdfa6d4a3b130cde6efc0ed3219605a2bb0329455ad65b6cf22c7f6233fd6b06b93359977b08d4e925ea907c7

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
178KB

MD5
0d2b2e772bbd0d5b7cb7e55fb75c81e7

SHA1
5d94dfd78eeb395cd2b6bdb7daed3e94d537d480

SHA256
63d3ac80f18e49cb7f80d5597a41d821c5758e8c84c55bec945849d04fad0ac3

SHA512
174f2b74ed6c0f1fbe54685d876eb740b1fe4d9afbbfd599c3ce8df32aff66a7c657948428487f098325ecad2e54cade25bab80b5a747d00b6d0ba5945d53f52

Download Submit