f3d7129f8b6b63b64c8ce98e0ade7240d447a7de05a8980270896782d66c659d

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03b5a9550e9c14603d10f5537129aa90N.exe
Size

34KB
MD5

03b5a9550e9c14603d10f5537129aa90
SHA1

b1c497b3b655e82fd971ebe567e4874ad589a31c
SHA256

f3d7129f8b6b63b64c8ce98e0ade7240d447a7de05a8980270896782d66c659d
SHA512

2e46554da582fb4b2e2deb202f0e6c16c536952e14d78b93fa9a315e42431407a02379ce259e40e7e9e453dd5bff9c99885ea353246861900cc2d35f3e1593dd
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHhpqW7U7Oof6:yBs7Br5xjL8AgA71Fbhvszw0

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4681) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\InstallRepair.html.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp	03b5a9550e9c14603d10f5537129aa90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	03b5a9550e9c14603d10f5537129aa90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03b5a9550e9c14603d10f5537129aa90N.exe

C:\Users\Admin\AppData\Local\Temp\03b5a9550e9c14603d10f5537129aa90N.exe
"C:\Users\Admin\AppData\Local\Temp\03b5a9550e9c14603d10f5537129aa90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
34KB

MD5
619d0c27a558261edb0d2a34538a91e8

SHA1
3806f146ab9abd16f84376c53318591a256cbdc7

SHA256
553adff5f10779840a1b8be08ec404dbf04652a28e1b2e12738381cb5b3f7376

SHA512
d960daf60617b621ec28e26a23abb8d8c65424562fa7c3a9f7abeb31da328352d0fde645e409dadb9ea4560fb7cbc07f620bed61b7c48e12401879b002203682

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
133KB

MD5
7e6518ceff1dd4be6c33d12f07cc2a4c

SHA1
94ec0f4690d012f5716dbb71f09df030643b5b03

SHA256
1de622f9833b58f042a822ddda563edc61dc71c65580278661ea2a7eb941e1ec

SHA512
71b6deb74f0b7fbcb6d948084359a0237943c527660c3c750c10c84eb940e25325550157efd0760ab10316ec810ff95687572c4deee0c80945ffd0f6a3524c6e

Download Submit
memory/3404-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3404-908-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download