fe7c2bd113dcffd420f876c57ced681b361e84c0c96d581f4adc4d89f718676b

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 21:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d33fb9303a019e932b218bcd680dc030N.exe
Size

56KB
MD5

d33fb9303a019e932b218bcd680dc030
SHA1

5a8535f1ebf5f32f97f444920573f6592d0172c5
SHA256

fe7c2bd113dcffd420f876c57ced681b361e84c0c96d581f4adc4d89f718676b
SHA512

dc5374ac4f4aa90cf3ba04a6f4e17bbdd599c99f3ce8e1fbc51d37bd6e5bb364c6e9afaf99b52666bcc21796b199c5ddf2d02af19dced9fec376cf807df23f49
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltIIRIfJiSAMMxQoBMRT3P9Pf:W7ZhA7pApM21LOA1LOl6AkiaaQok

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4537) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Java\jre-1.8\release.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	d33fb9303a019e932b218bcd680dc030N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d33fb9303a019e932b218bcd680dc030N.exe

C:\Users\Admin\AppData\Local\Temp\d33fb9303a019e932b218bcd680dc030N.exe
"C:\Users\Admin\AppData\Local\Temp\d33fb9303a019e932b218bcd680dc030N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=1440 /prefetch:8
1⤵
PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
57KB

MD5
b2768a2bebce10071d95d06aa51ac7af

SHA1
3015b113f53e5c61a97008502e84b3e0dfd9463b

SHA256
e315020fd50eb94527a650c81298e2b1b25b8a763b2d749be36c64f9ec86daf0

SHA512
0e2c3f89e8b23e65126c7ec6f5cdf65be147a48d1919fa8c420add6b77bfa4ce467a11647277cd1514ceec856d026f68e782f33c345178e4803a30b43d566296

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
169KB

MD5
7d8ee8d011134916f158d34bcf7d377a

SHA1
c23fe505cb0c75d10b5677e2a23386bdb83e7118

SHA256
c0185c26666a6b29e4913eeda9c0969ba807c2b55409b41d5db44e6cc3cdf96c

SHA512
693d91ba4ab2d7958b3fb62ead873215fdd38832ca4ca6a12e36fa748dfb154bb43e9c8831c1f664c2f7ecd93475e3852cea3f358a0774fac6c5cba8ce2fbc20

Download Submit