92a6530cc213ede95ccbf1818eeaa0f4aa3653c820c78fef874e53258418ce9c

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3b512ff0aab636431b6275676c206880N.exe
Size

53KB
MD5

3b512ff0aab636431b6275676c206880
SHA1

8a195d286f83c09fcea4d3b8261ce68282b06615
SHA256

92a6530cc213ede95ccbf1818eeaa0f4aa3653c820c78fef874e53258418ce9c
SHA512

a1bcad18e645d61a8db1ebce7feef32b4fe7b91d9e5eeab31beaefda03e0d3e163293687f8e2cacc94818d69d5029a63292ce2e20f7ea2b47a6753a4d6fa43c7
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFXpK5c5cvLknXGIIi1xgknXGIIi1xt:W7ZppApBULcfpHLcfpyDA6KvL3+83+J

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4659) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fil.pak.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hu.pak.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl.tmp	3b512ff0aab636431b6275676c206880N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp	3b512ff0aab636431b6275676c206880N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b512ff0aab636431b6275676c206880N.exe

C:\Users\Admin\AppData\Local\Temp\3b512ff0aab636431b6275676c206880N.exe
"C:\Users\Admin\AppData\Local\Temp\3b512ff0aab636431b6275676c206880N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
53KB

MD5
9ce369545da9f0d7462cdda62e7c92f8

SHA1
1b98a4056500007dc8b798119c662f28fb825858

SHA256
ce365ecfe163acb2660a1c35e24a7ca89efc7b9a160b9228065cc2be6f22727f

SHA512
d7bc0d2922eaeb500bba746f7acb311ff4c45021f47accb066f3dd9275b25f20532eb7275af5c097e003f7bd4f372185ec88150163ae246ea9b873a643834dcd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
293f643e39e971aa2dbf4f6733690087

SHA1
06e0c8d73678a541b2184844cffed8ac1e1936da

SHA256
0105296bb82e8d5771f78338a8551eda2693aeab3b6ec12295c30aa17a65f652

SHA512
64a346c9a231c8c4c4cbb984abd4e13daacdb056737eab0bd2a7f348674a4e3d76772d15d7e25d14908f8a6a10a91db2110fe5d512994dc0216b857cd8625654

Download Submit