Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system - submitted
22/05/2025, 07:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe
- Size 34KB
- Sample250522-jefgjabl7x
- SHA256 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a
- MD5 e5b7a97c02b5b408c71921f4ca967c9f
- SHA1 63084302cc2b52b5bd234b9cd53307ac81b63513
- SHA512 9577fa142846e86b5a8492d8ca072619cf92f430068b7fc95ec346e7ba599e3966cbae75c9adf08b25be075eb8d02afee21de31cbab4d6e08824be69820f3deb
- SSDEEP 384:hAg+5OCZ4W6/KWLsqmFae+rOAqmFae+rOfijcijK2J7u82J7uyOsgN/OsgNE:uZ4FLz8ae+rOn8ae+rOfXqJ7gJ7owE
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5133) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\WindowsBase.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\WindowsFormsIntegration.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.StackTrace.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\UIAutomationProvider.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Xaml.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\PresentationUI.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\PresentationUI.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Office16\OSFUI.DLL.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\catalog.json.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\WindowsBase.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\ru.pak.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.FileSystem.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe"C:\Users\Admin\AppData\Local\Temp\3656fa490d9aa99ba05dac8b83bd62ce661b9c1223cd9d65caf52059c57bcf8a.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3572
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3299287909-2279959458-198972791-1000\desktop.ini.tmp
- Size 34KB
- SHA256 c5752e5e2aca0d5927e28001901dfd725666d7e8f20a657d99e6552100a6e1f2
- MD5 36f56ed61b51d0ed8b60e19796bf6ec3
- SHA1 2075864ec11d5e1e950c7f2213e1e8302a47677e
- SHA512 76f527baed294f3535934c4fb76a898403be2c51b1eaad12e149c9eae1ec32d0016118cb2a6b5b087be1797eaa66a1326aa12d570f630d450c21490ef4662954
- SSDEEP 384:hAg+5OCZ4W6/KWLsqmFae+rOAqmFae+rOfijcijK2J7u82J7uyOsgN/OsgNc:uZ4FLz8ae+rOn8ae+rOfXqJ7gJ7owc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\8e056885788215100b95f8050bba49\2010_x64.log.html.tmp
- Size 120KB
- SHA256 acee26c815505ed5602670c84ac304f59fa78cab7606026cc3377c41490b2267
- MD5 3d7593d05ff9594f0c387caacf16e564
- SHA1 fec05635a5edf65103b19e791a56feb7560a186f
- SHA512 f36002e0aa72f95530c470c6d134e8dee5d0fca11e850bff51b8e789fa174a33817a9877fbf318181c4d34e49f0fe7bd66fa6f91100e4c41f99ee0963dec1f23
- SSDEEP 768:uZ4FLz8ae+rOn8ae+rOfXqJ7gJ7owsVyw7onC/+tdhRBlIcaBpM:uGIISJ7gJ7ow+oC/+tdhRBlIcaM
- MD5 SHA1 SHA512 SSDEEP