Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe
Resource
win10v2004-20240802-en
General
-
Target
3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe
-
Size
88KB
-
MD5
6b45ca2ca23d3270ee0f636d25545610
-
SHA1
cd1dd0612596d59bcf1e62b6aafac414d6dd84a0
-
SHA256
3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6
-
SHA512
e30194ef0e5839c85d76e78a337f2783fcd809f6a09235d93da57b50d97050d542a45b9c2d17e572556435eedbf42252001441b3d0d06f69f681b4c016f674a0
-
SSDEEP
768:/7BlpQpARFbhiWb8naOnaBGNS10w2Yw2f:/7ZQpAp/Eaiax1t
Malware Config
Signatures
-
Renames multiple (5005) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sw.pak.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\office.core.operational.js.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\cs.pak.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es.pak.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe"C:\Users\Admin\AppData\Local\Temp\3a0a366449b7dd3d3a9eae9253499312092a0ac6d179a547320852cca7f019c6N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5dbe35cbf5210fbf810e1a542f779e4f1
SHA1d81aa1dea3c6d97a7175062f5301172f89069e21
SHA256dae24f88a0fcf280b32a376e1341c1f5e98d893ec92a92f1c3d849a089d8f47c
SHA5121056f10721455444ac22fc4db493afa5e70cc6b04fa21047788c6ec364a870c4cea5d3af82e02426d5a339668bb42c3f70516487aa0b613edd5b443dbc8c8055
-
Filesize
187KB
MD5c3ddea3135532abb45df4fc48bb2e60e
SHA17cbb92f0a2c0108056c52539231ca77f01a26b7b
SHA256645ac37bbb210d7d70367e592c006af3570492c9b7fe59a08bebdb949bbb080c
SHA512c22e71c776c7b9969a58736d15534ae8ae49a2b3aa450ba1e90ed3c03ce33db62f8b6cac60f03ea9ac3355d11564b058f2027340f625c593bbd55f4f44ca17a5