3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
Size

37KB
MD5

f80500ff2a5244b90850ff315477b3d1
SHA1

a5ea6020495a9af0982da22ae4bd0759c87d06c5
SHA256

3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b
SHA512

c13a369fdb4d7836df714e1ac5c4cb1cda9123d75bbbe95b15dd2fb0fea936cfcf9633333efdfd6e01946b6a5b9e271a09c1c0a24baa59e7e505aec565fb330e
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHdGeqc4SUqUGeqc4SUi:yBs7Br5xjL8AgA71Fbhva4S04Sl

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5214) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lt.pak.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe

C:\Users\Admin\AppData\Local\Temp\3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe
"C:\Users\Admin\AppData\Local\Temp\3e33fb1881320abf39fbbb899d84a0fdf663ac4953548615584404101c9b107b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
37KB

MD5
5997d3517e7aa64d18a12ab961a6ad3e

SHA1
84749933d1a3f66046836fe89876d7c4d5de737d

SHA256
61db9a5042d0b46eb8209f94ded2250891a161fedb3b5d5c348e758d2a92bd0f

SHA512
2579bdf05f733c7d7588ca774b6259b856894d52385fcb905728f5b2f1b75ce23a59ab6e8cd37b7ac9c9a585cbb2ba7673ecca323dbaee0b20d6a12f6b40e7b2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
6b9a7a4e8770947b669954b35052e1d9

SHA1
2fc39e99e63a8a37ebb8be42803dd6865a31e5f5

SHA256
43eb438dd729bf01da0e66452b19fb100e5ee252965f4e2a262452e5dd51aba5

SHA512
da9e38ae131f48fd84ad93476140109a0cd94e24fe7b477f5bfec6b26170f29a27ef90eae733b30f1ffae18c12b7e7d934139cc94eb7d1a6bfcd06820f4ad1be

Download Submit
memory/2096-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2096-908-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download