a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118

Analysis

max time kernel
119s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
Size

38KB
MD5

904f02cf7a94c9aa73ea66150ab376b0
SHA1

118e72d9f86c996f4b8eda20cc86659f85ddd4b4
SHA256

a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118
SHA512

8893a47a2ec6230824d9936f2ef563e44528829695a1d4812261ef00b81d4277b838239b332fe0b2b977bcde2afb92803d778c16b66b4dbfa9399f0154da3959
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lt4V0IhAFV2RuH22V0IhAFV2RuH2Q:W7ZhA7pApM21LOA1LOl6AE0IhAFV2RuQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4670) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\af.pak.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\msipc.dll.mui.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sv.pak.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe

C:\Users\Admin\AppData\Local\Temp\a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
"C:\Users\Admin\AppData\Local\Temp\a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
38KB

MD5
49d740aba1bc6b31bda3f47043517a12

SHA1
3e96d69a19d1d483201bb83812f43f979c2f97ff

SHA256
3fb78fd12180cdb53ec5906a18468ccf4dfdc7860f6e6dd68a6d693298fcf306

SHA512
81e78e424639dff618d24c67aefdf4858df4dc7ab8d3058f9772bf2c37552e012142963c9304729cc32891ad3afff8f2da1940655e66fdc0d728348a0e1305e4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
137KB

MD5
34919869832e115a1c4c92260f182035

SHA1
82602995b2f86940a4c3ecd9831900b4db2a966e

SHA256
ca9600460a6a370c284a92399cd64599b8edd05d18cf74ba3952b68a549c27b8

SHA512
bae8db9326a1099139cabd8986d7b2015c30b8807f48377a818e2ead1a17fd3361d4a567db674b84f3d221ed75ab85846d34719c3115a7edf931ea0d828bd571

Download Submit