f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76a

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
Size

56KB
MD5

f4cd13203e9bcc1995a7605c5e606d20
SHA1

fcc7aa4ff57deb4f3dbdda5844524142d67c6799
SHA256

f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76a
SHA512

927b752f6392c52a1dd0008e4b8f291844be5161f09242b8021c9d3127fa5711ea56976473a26e393a37e2769d12b6638a7eb467e3d677108c811a21994b21f8
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJwRJofJoToYvJtLJtq4q:W7ZppApaJofJo8YvJtLJtq4q

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4643) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSVG.DLL.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
File created	C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe

C:\Users\Admin\AppData\Local\Temp\f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe
"C:\Users\Admin\AppData\Local\Temp\f38380ab1eaa821e3eb297c76b43787406ace328a9a79c170c14c0196b94d76aN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
56KB

MD5
e1843c41db585efb6eee750c6214a6b1

SHA1
ab5886b9a75cb64f9a3e8d1e8d729b363739450d

SHA256
a3f0464ff7f2b596de88c4d53eb20c85f6ca2df3d3846761b57ee7abcc3b4eed

SHA512
08241b1343a8e6816808c040c36f63dd740141a543f46843bc800467d7ff503604698d065af587676dbe90480c06812b96b66fdb4ba096a50fdb2d7e335d0191

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
c33fe6f2fbe0ea2189c94ea9665a4137

SHA1
8d2a80d5947c38d6ed3432aa8b1b6dfdd2ccda70

SHA256
7ddd6322bd61ada369dcebb15057c66aa61a37c3b9b7a895bbd569d561ac38af

SHA512
8edecf11702091ce6a25c32f9b09cf16f5091115865c2aed735f5786ee1c4d9e8e895fa0c8c47a4fd4e1908d095c9b721d65d67b068b2d8a7df336bf234f31d2

Download Submit