39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfa

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
Size

82KB
MD5

e4eb8649059236ca1f5b58f13c9bf600
SHA1

dfff875006c74fa18e322ddf2b1eef53f313f466
SHA256

39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfa
SHA512

8f0976302b5e3a9360a4ba63f9a91009bb0beab2d8200bca61037dfd005f91c94171db6a911650af25a602f38d0fbd9c30a20a3fc6fe4676490af716c0dca6a8
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYs:6e7WpMaxeb0CYJ97lEYNR73e+eGG7

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4620) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsFormsIntegration.resources.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.MemoryMappedFiles.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe

C:\Users\Admin\AppData\Local\Temp\39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
"C:\Users\Admin\AppData\Local\Temp\39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
82KB

MD5
0190f7e4d257e680db0a4c3380b69cdf

SHA1
7ea396930472c7c40f4fd8874860cdff3049bbd1

SHA256
8b4d7ffb9bf2d4d78d9e5c37fffb8576ffa164981906bef506aadc2d51c69a83

SHA512
5ae25d3d2c7175f99716f0b051a2bf0fa463b2d4fb8d19cc200c83fb15d3fe8845bb97bd7920650e319fdab56fdfb602cc4e05feccf110da54c27e2d1ef30eee

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
181KB

MD5
f3bb17b5419bab546535bf4a4bf10679

SHA1
b4d2ba1b9fb0e5d555e7f5f3152a268f6bd50e60

SHA256
133f9be8643ff4a3c07e807fd098d4bd8f71a4b5f4a38454b12101cc44438f99

SHA512
337e9cf892809599056befb1141389e479563405e74c32d8fc152ab15af38f9ea9c95740174dbf9b026b027a8fe176489db1bf30fde6847a1245066b2dae9b5e

Download Submit