c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
Size

46KB
MD5

72da1deec448f089f200135bbd265cec
SHA1

33e8f6e1c8fda431f772d43959bd2348314d693f
SHA256

c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d
SHA512

a377c6913db7597a1ca61e120f20489783009fb760d189924f98bc6eb70fb7a0ca17f3e75f4bea56a99062b6158b85c985811e0d55bd9b0d26cc32ca539af220
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLcX4pNX4pB:W7ZppApBULcfpHLcfpyDgpupB

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5260) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe

C:\Users\Admin\AppData\Local\Temp\c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe
"C:\Users\Admin\AppData\Local\Temp\c3870f283a48fd534db6ed144d9691f2ba3f0f5d8c0bb16c9927b31b84d1d27d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
46KB

MD5
1acc4fa2ccf5c949a11035bd2d2d001e

SHA1
c8fff87339a42bdf90ca02ea9f98405388c554ad

SHA256
bd0b056992562f145e3872b205ad7b5b7fe683c5000b2271a94008188e9f4ce4

SHA512
bbf62fd31c2e839cb161c163e66071163a7d35b3d688bc724cacc7cc8e4c1ea0752c23bcb383d17f121f680bf4f7784f399ef7964821da3ac7708d1935aa3e02

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
93990031103acd93ee3df5d395303f9e

SHA1
a8e536456402c5d32464fe6aa3274644c0ccfc2d

SHA256
3b52dad4191f62e74ceb76360f1291c43657784daff5b8d285d7980179c4e445

SHA512
ffea076d61aef671431862440855c0c25cbdbfb74d11eb4ce6cd0ffb012314c588db8f00eb0ea00242f96837c4e440d406ea67eb6f70ef31d4db9f04656932d2

Download Submit