3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
Size

38KB
MD5

b60a94dbe886161fced9693b4c331a70
SHA1

305e662e530caac532264898f8dc755b4bd1d863
SHA256

3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377
SHA512

135360e2162a1de66c03a236782c22fa8ea59130146d3625476164d15637321624fff16b06a645d31df3f6f6eebfcc9cd72bf0dfde549bcadc044965cb3a575b
SSDEEP

192:tACUADIY0Br5xjL/nznlAgAQmP1oynLb22vtI0zWXPXUXHz9g5JHz9g5Dabb4:GBt7Br5xjL7lAgA71Fbhvt3bu5c5D/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hr.pak.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe

C:\Users\Admin\AppData\Local\Temp\3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
"C:\Users\Admin\AppData\Local\Temp\3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
38KB

MD5
e8d5d98579754e8f5e811e0ed9e81601

SHA1
9ed57ce978757deade6b85540f99c4825066d4c3

SHA256
7158582c0bbee1a8ed7410698e37917525efb0b3293861a11a559c459268cd78

SHA512
ed965dac921c897ceeb530fbced8ccccb9a9268fddd4dbe084df0a07d33857e3208631d2b4a8b28cb86c8419a769b6c1ac816375d64a722523d6d724bc23e449

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
137KB

MD5
61cb137fb2d1e1ff3b717fca9950b370

SHA1
80cad84d5ad3bbc5667f945adb34444ae564ce17

SHA256
042a5ed55a72c101494386289f153eeb9f02d0ae652739b20a8a6277af864a4b

SHA512
40e3b168ceb2eb2658d0577d7b304cf815b88fd5abe32b289895e0fec4887b11cd5e1d5addde4fdc47f0873cc71cfe9daa5e0726aa17f6f878cb73312a6ee43f

Download Submit