2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
Size

99KB
MD5

54254a1942926fc50319db2a2c14088a
SHA1

7c2810005f3652b7c54f0727ca9d819090cda61a
SHA256

2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374
SHA512

187b19ae7e74435109f2052c21e36f58a6575817d4718dd0bf6de21b6f151a71a3c641d80077ecb966322e8af3549a42e431aa31e50d98aa0630139aef8cef59
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBI:PqFF2Ie+efsim2b

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (773) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe

C:\Users\Admin\AppData\Local\Temp\2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe
"C:\Users\Admin\AppData\Local\Temp\2323df1eeff2f967ea666a2667b91eefbd6a1ff983c030c0ca839a7f7fe8a374.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
100KB

MD5
4429543055ca1b22b8c52d88a7908278

SHA1
0a1dfcea0e66d293f125f3737cac268de1994244

SHA256
3473b978a0b76ede639354aa61b68eb375b1798c1a68422009a4f344f06f7878

SHA512
ef1285a00db0233301f857339245eafc0f025dccd76e39ede73b8c75ae32e1c6c2090dcc8ed4f07def33a36eb0aedfae56cfa781d2ef027d9ac8139a2de80957

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
109KB

MD5
e978eb89aaca6ccce32c944fe8d01ac6

SHA1
43ff413ca1d19d3a37720c0dcfe5fd16c2139b13

SHA256
3c61f0c6a4ba550be526dd67c735d3d876c8f6baa3c358b770ef392335f0a1fa

SHA512
d22c173530c344030fc800f93fe2b3b76417f8a2bf1d5eae6ca8e6a60417e72e328c955bd394d534656432296193ce336f70190f3c4913e8ddafbae054448020

Download Submit