d31bf76aaaeeca973ff1e4a3648eefd638977bd5409f47ac576be4ed65a48d89

Analysis

max time kernel
119s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

341962d19972c5a639b315c9ee796cd0N.exe
Size

45KB
MD5

341962d19972c5a639b315c9ee796cd0
SHA1

c2d3ecfcb041425822209ec75e21491c2556c977
SHA256

d31bf76aaaeeca973ff1e4a3648eefd638977bd5409f47ac576be4ed65a48d89
SHA512

82f3442307c57f0f04bb2fd5136d23ce93dd2138f840e0ff4ecca2d4664474377c1ae1a255c32c960144375ff0239bc5ceef93a495cdff3aae5a16f6811f4f22
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOd+KF/MF/i:W7ZhA7pApM21LOA1LOX2q

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4658) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000C.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp	341962d19972c5a639b315c9ee796cd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp	341962d19972c5a639b315c9ee796cd0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	341962d19972c5a639b315c9ee796cd0N.exe

C:\Users\Admin\AppData\Local\Temp\341962d19972c5a639b315c9ee796cd0N.exe
"C:\Users\Admin\AppData\Local\Temp\341962d19972c5a639b315c9ee796cd0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
45KB

MD5
aa9d83df447235196c3bee6995ed9642

SHA1
ccbb2a62eb0686a102d6859cc986813d8007148e

SHA256
2da19aa6d87b86029d9422698e4c0ac8ddceb2ecda76173be96cc27f96206d40

SHA512
f97f75d63ab2537a9bc3a79d8b8b5fb05e62d6c71e05afba659eab2e95e9a83cddab341a6ff7360a99f1883edceea3b851280a884ed00e8857f8bee0a697af49

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
b7e11c534477524e8e40443bfc8e0c07

SHA1
2615e0076be3378cdf41c4084a63c49cc6581ad6

SHA256
611aabdca1d8852e666abaeeae10a905ea27ea9169dd35c62dee1de01454813a

SHA512
f0adc9ed71aa626f14c80ff56b626fc1655091a11923724374713a1b6a2d962120114010bbe4838c708b278604c3a144930f6c85d395a42f3a5da0139abbc65c

Download Submit