3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
Size

37KB
MD5

6bd5be2d2cd72ab13a0b0faee8e28290
SHA1

512e332ef21065bf41d11ea9d7a6e340c95ff59a
SHA256

3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9
SHA512

0319fe096475f88edb3f64d21fcf6595d55c651f29ef33da9ec4b703aa2042fb8d1022748ecaa9714d155192ce948627c51e7ddcb18a2d698b54af23d4eb1b17
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltE1k:W7ZhA7pApM21LOA1LOl6A5

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4721) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe

C:\Users\Admin\AppData\Local\Temp\3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe
"C:\Users\Admin\AppData\Local\Temp\3b63ab95448e35e1fc82ac4b8eb23233771003f3a705eea96f4955328d4eb8a9N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
37KB

MD5
2f1c5e68448d5e3cceea467394471302

SHA1
271c2b894795920f9ba0f1dcbed1a5a13024f2b7

SHA256
a12be51b5e3e13d8db66dbb1c730ae98eac677696238129ebb5ad5a2213e7f29

SHA512
db0b3d697e05b65dfde845078403a0678a9c2a1a236efd11d6f2b663045249dde73fe9c8ceb1ddec5a492ea185b56f0203ab1ba565c256b70908a56ae74bb28e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
e867a023c346dad33555b48c5e492bd2

SHA1
cda7b0763785c4c826b9d887d8801dc1caaa10a3

SHA256
07f8711f7e173fa966cc11b9b63036ccff29f81de5e352f9c55f41a40372ce5f

SHA512
c49ec67912fb0855f954ed3e5960c2e722138336211d2857cbc45d79c181d76801ba18a1e0197836c4e0a0181bbcf074835d03693603c017bff8af03b1321cff

Download Submit