Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2025, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe
Resource
win11-20250502-en
General
-
Target
3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe
-
Size
84KB
-
MD5
bf8878419427e48eeddb51940e6c2d2f
-
SHA1
4184fbf2fd60114e0459768dcf727053d2beefa0
-
SHA256
3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb
-
SHA512
2dea4a8c398855c1d398fa407459e9bc90fadf89f3870c5cb3e43b7bedbd2497fd9172f935d7945c1b8be0a12b6d2b47a9786db250c6b392539ed1a18189ae9a
-
SSDEEP
768:s7BlpppARFbhdLz8ae+rOn8ae+rOkBnpdnJdL1JcdyadgpAdRdYkq96QdMYdmJFI:s7ZppApdII8JzT0xs
Malware Config
Signatures
-
Renames multiple (5029) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Process.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\UIAutomationTypes.resources.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\WindowsFormsIntegration.resources.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\ms.pak.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.Win32.Registry.AccessControl.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\WidevineCdm\manifest.json.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.UnmanagedMemoryStream.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Extensions.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationUI.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\PresentationUI.resources.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.resources.dll.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe.tmp 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe"C:\Users\Admin\AppData\Local\Temp\3ff67f2622d80e87879506355aa5640427575f280935a7dc0b5ffd69ebd38deb.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD5d491d13b09b12ca4297ade5a12144804
SHA1a6478756eb8c99cb04f4a091655d4926a5950565
SHA256c70c6c03aa769ecd490d5db44619e38598737100cf737200c3d9c67e5e1d0cc7
SHA512a72c5dcae36d26da8cf75ba67437b011c5bc26ab893545018f3bb07bb4e6e44e065bc861b4fd88e66e32e8a1e1bd798e492ae2926e98d8a59169d2ad6a4bd5b9
-
Filesize
166KB
MD56f17af4191b4eff971e7f7a0114796fa
SHA14d916b5e6ff8a5572fad6ec99c97511a7dddd3fe
SHA256f0fed6de2dd72e7a8eb4a16df9f0798a504ce533607374fa64149ed2c3706343
SHA512dc55fdb3033d3515805f5d8b6d2f0fc6b0f239520e779c66db6520977bac711b8e810284c28082514ecb90f76d4a977104e95d915e65f67574df344e83a4683c