46912a80df85547cd4e0bdb51a3a8befea752b8c847cd7e548e4f9c89df2f542

Analysis

max time kernel
120s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3150e99f43daa042f550977603cc2040N.exe
Size

62KB
MD5

3150e99f43daa042f550977603cc2040
SHA1

b195a0d739d7268e243fe2d1b8aae0cf212c15e8
SHA256

46912a80df85547cd4e0bdb51a3a8befea752b8c847cd7e548e4f9c89df2f542
SHA512

b002aada3ce95b873146021168031abe8b5576d1b7058cf7789d1b019919e981ba7bdd4e2987f1d399863164a627b43a32bbd0f7e6bf7ebb654d27da93878272
SSDEEP

1536:W7ZppApkxUYU30NQn0NQaYioumdGwmdG8:6pWpkc0NQn0NQq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4374) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.AccessControl.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ca.pak.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Types.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp	3150e99f43daa042f550977603cc2040N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3150e99f43daa042f550977603cc2040N.exe

C:\Users\Admin\AppData\Local\Temp\3150e99f43daa042f550977603cc2040N.exe
"C:\Users\Admin\AppData\Local\Temp\3150e99f43daa042f550977603cc2040N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
62KB

MD5
fbc69e98af8344e10b8f1682a76e9d85

SHA1
526e7c41aa71e59d8a6ad0a2b49ed9678c8aac41

SHA256
f9458e3bf0af590684f59b3a6de8601d6dd89fb290049268cfa7291d28a43f20

SHA512
cef3c5d2a30383fd8018b63331dcc75b6ef927ecb92524de332c723d575f6959ef9dae6c9bc615757d0ca306b6b480d72e5776318b3b575cbca711204629309a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
161KB

MD5
55d33d53c2ccb506edd277c26e5ff1be

SHA1
8c66b964e753664038b04c6cda9ea7a35cf9c5c5

SHA256
0f3434205fb8238102e5ab159d53d2f4000bad04bce2dfe0a5ed9c0a867ead46

SHA512
786d913f12a2fad13bdbf174d8c6f7d3a61c20537137475e9e60b1bc9693fcd945cc830529a02e42e81956d1d9deb958c6416c8bc0ffb595f3855cc823ba53ab

Download Submit