39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dc

Analysis

max time kernel
119s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
Size

48KB
MD5

4420ec976651f51f1b1824cbf9e46f60
SHA1

dbee1812d7ad28b8c4b6c8b3457f7f29ff2e75df
SHA256

39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dc
SHA512

27d05ce5ca30174727a1128393482b88ee3ac44112a5874373c73f806a6ecdf7493d0fd401b90d5c3a3258984b9858cc19f7a67a803d85c80ef35c6baf21452d
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1itvtn5Gf5GK:W7ZppApBULcfpHLcfpSo3fstvtnyz

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4620) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\et.pak.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\mr.pak.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe

C:\Users\Admin\AppData\Local\Temp\39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe
"C:\Users\Admin\AppData\Local\Temp\39d93c292fe18ba1ea6fe10e1dae71201952e84e3cc2af97846549fd773a88dcN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4344,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:8
1⤵
PID:3208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
48KB

MD5
283283eb95c5949decee8e475360e835

SHA1
1d1f955ebc46adc22abc0df37501f76f0fb8ba22

SHA256
fcc4ad8accfceb02598ddbfa4560dc983533a442cb7b46492349d9b9ac9f9a25

SHA512
dfd66b403705c8d0a222a26a9c335150a0dd92870140ae5289bfd44a4453daef3387ee5f82e9262634f6606c576d6863243863ae642a3f15b9cad139ea1f4398

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
161KB

MD5
99ae23c15feeef792972ab27b7779c61

SHA1
2f42e2262413c9e8776dcef38dfde55db674c7ae

SHA256
f07fab69f3081d72ab4851ebe2b7674254df1aab7a3f04637911c812b9d29075

SHA512
cedfe550fba0c65775c8b5bc33f96da2421f3cd26bbba3121dcb6eb6bf596cf76c8a0614f6f8e323238eb90d16358b5273ee0c0410b458a07d070741e989b2fb

Download Submit