c71e1ee98e816de91cf54190874f20056319951cad99ce8982fb5e1aa93b02b6

Analysis

max time kernel
119s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3d0f99dbebc068933bbbad5008bc8a0N.exe
Size

37KB
MD5

c3d0f99dbebc068933bbbad5008bc8a0
SHA1

6a954b788075bd8583c1af94064908f42adb03f5
SHA256

c71e1ee98e816de91cf54190874f20056319951cad99ce8982fb5e1aa93b02b6
SHA512

405cc05cead50c8b2d7062bedc1439edfa352f18fb005d1a4027269300248a7cec6b2015afcd855e3ee3c055b21492f9deed1cd02bb2b685588a2cb2eb28baeb
SSDEEP

192:tACUADIY0Br5xjL/nznlAgAQmP1oynLb22vtI0zWXPXUXHz9g5JHz9g5y:GBt7Br5xjL7lAgA71Fbhvt3bu5c5y

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4655) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Xaml.resources.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp	c3d0f99dbebc068933bbbad5008bc8a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3d0f99dbebc068933bbbad5008bc8a0N.exe

C:\Users\Admin\AppData\Local\Temp\c3d0f99dbebc068933bbbad5008bc8a0N.exe
"C:\Users\Admin\AppData\Local\Temp\c3d0f99dbebc068933bbbad5008bc8a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
37KB

MD5
ad6a55a60b12c69aa24ce4958e075201

SHA1
a2e114f647b888e69c9792a64b25a28dd2c7fa58

SHA256
e1ee2e6627fb5e3b7b0bbe4b33749ee83290890b5753bea58e2fb38cf3275669

SHA512
6df689f9dfacb5c34c4a88529cba963b637d35412e7fbf114b9df8c068dbc19196f90a3f0da35ba544fd879b2f637ac07b7bb7547e7fb52b7b03c6504adc1326

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
e84bde390edfe0404bb00c65380c5dc0

SHA1
9e9db20506738398cce89d32d92cb76ab9251e92

SHA256
3ad6835fbec28f73472dc26e63c84fc9b344955553039588001a91b8846957f7

SHA512
c63c8b0c88e4ef70e0e563debf4235d41fe47f52e3d682d749fe637189d9c7f7eb92a798b6ce57ab77c32476f67a3208fcbcb0e32d2b3fea7c0df5a510056211

Download Submit