169f417bbe8ee8e75fdf0cb6689bb389403052e14840f31575da468d417d90ae

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b424ac98c1426db46efdee24aeb9580N.exe
Size

87KB
MD5

3b424ac98c1426db46efdee24aeb9580
SHA1

8f440d4993bff12aa554422aac6e7026435605e5
SHA256

169f417bbe8ee8e75fdf0cb6689bb389403052e14840f31575da468d417d90ae
SHA512

c0c7bc0c90cd203779b8fec7988225566cc6e1f7583023600afd93b11b1724d7475df6a230a45eb290195cbb03337acc3a219745ea8249ddfdf7c7370e143cfc
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYY:6e7WpMaxeb0CYJ97lEYNR73e+eGGb

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4642) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\deployment.config.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp	3b424ac98c1426db46efdee24aeb9580N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b424ac98c1426db46efdee24aeb9580N.exe

C:\Users\Admin\AppData\Local\Temp\3b424ac98c1426db46efdee24aeb9580N.exe
"C:\Users\Admin\AppData\Local\Temp\3b424ac98c1426db46efdee24aeb9580N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
87KB

MD5
1bcd281186bb5655fda9091917e42b61

SHA1
7a3bc2c9ee81d244bd9440e1a0e9dcd8e4158620

SHA256
9c3d29629fc4776a1fec4d9f1e4af34d8986f22712d57222ed45137cca93064a

SHA512
13b97c510e63895ed7bd5b149409161aedb49200058e55107a27a76ab79e3c6a629cc7c8541f9f9823a388e01218da593e21f0764b53fc2c4334279191c36136

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
186KB

MD5
d8e50df494d3e1ee0dd821135fcebb1d

SHA1
cc90809cfa188fd7ef6e97e4eee6fafacff0bcaa

SHA256
ffd5a7e7251ac12fa830de4aaf03ffce858da1d8a0b1b894a65abd5e94bbc781

SHA512
e5942dc57f331fa91a07238aec831e626700624189ea9022740e7e1069a88b3dd7bb4145823cb7cb969f7d1fe525f8add5a577e49a970a92240f4c7cb58fd58c

Download Submit