73fab2451ba1ce00ab48d90f70ff3fa63289aefe3cc66ef853f85fcf3f4eff17

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3e728cfb6bce216b9dcf99364704b440N.exe
Size

86KB
MD5

3e728cfb6bce216b9dcf99364704b440
SHA1

f220201cdcc0d51c671c192193678385f76beda4
SHA256

73fab2451ba1ce00ab48d90f70ff3fa63289aefe3cc66ef853f85fcf3f4eff17
SHA512

6843913ef0f49600bb85d83606a8cd9621a7413af70b62ec007d5967fcaaade7e6d3b023938ced67e94f92a1b73252dfd9b2848ca697ef1d5443639dc2057cca
SSDEEP

768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORReT:W7ZDpApYbWj2WTWJe+e/qXhgOHC

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4351) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	3e728cfb6bce216b9dcf99364704b440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	3e728cfb6bce216b9dcf99364704b440N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e728cfb6bce216b9dcf99364704b440N.exe

C:\Users\Admin\AppData\Local\Temp\3e728cfb6bce216b9dcf99364704b440N.exe
"C:\Users\Admin\AppData\Local\Temp\3e728cfb6bce216b9dcf99364704b440N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
87KB

MD5
dc61cae81d0d5a489451e6469c3ade45

SHA1
71723bb979e97da3be1d5081b5f1e347d7b9c447

SHA256
afe1e5f204c96b9015151bc8586baaa171f9d281f53d0bee701fe8836dda8b2e

SHA512
4528e8a8901a1fbd9c21d15d7adf0ed7e1b8d5a4fd48d03de3d53df9d58396edbf7a727dd05eeba1159a738766c668d1fb105b5938863a9faf4bde34d9193196

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
185KB

MD5
d7db2226499e10f997c941f5ff5e6374

SHA1
31e3669b3c5668af6eb4d75da4759d10286ba4b6

SHA256
3090f691d5ef05d0c7c907702e1a63b5ced43ada257bfdb484997099a18b04b2

SHA512
517e45d29b559c728ca8b2686bf4202badcba27891b3788224138be8e91316940de84c0b208591dee0f3fa0d43ce0a64ec78696f4c066ca0fe6a65f3ba61ef3d

Download Submit