d3dbb999bccabde02965215310c668fdf9eba38317dbbb631801291a5e41b77c

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ea4e957a902a6405c52a06b682f8f30N.exe
Size

58KB
MD5

3ea4e957a902a6405c52a06b682f8f30
SHA1

1931d2f18aeaad356837bb4a82139d56bcc28d81
SHA256

d3dbb999bccabde02965215310c668fdf9eba38317dbbb631801291a5e41b77c
SHA512

1b18e491ca0f4d15524c345beebcaba6952230e85ef8aee7263f6d9614e0be0f63dd325c51440cf06be37aa95bfae9ee14ed1ac732d88fa89658e7cb057e8ecf
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/T2wqv2/:W7ZppApBULcfpHLcfpX2/Nw/Nwmxk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Brunei.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Samarkand.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\DVD Maker\offset.ax.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Anchorage.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	3ea4e957a902a6405c52a06b682f8f30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ea4e957a902a6405c52a06b682f8f30N.exe

C:\Users\Admin\AppData\Local\Temp\3ea4e957a902a6405c52a06b682f8f30N.exe
"C:\Users\Admin\AppData\Local\Temp\3ea4e957a902a6405c52a06b682f8f30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
58KB

MD5
90b4b6e09e0a60b4e1eb9c7bbb16e642

SHA1
0961a64a9399f215d3366942839fcc2625960f0a

SHA256
d626dc649410e127967b3ecf60ed6881cd51cf80aee409393dd8762e5ac67c0a

SHA512
64f5fdbe0a8a077c8c0259270acf6e2c4121a42021f83559d8fc05a7bf89ac05178e43c4f30284f7cb7efd0720be3f23a1f51f29c18453d8adb2d9c5089ae64f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
67KB

MD5
5538be75d2adfcae2518ad72fccac9da

SHA1
4328d984e275dd80358ed8c760d9dcf5ebb5bb10

SHA256
496dc08eed15cca38e28e2ddea6d6c2e17edd1012b9beec47c59efee3f6d15e5

SHA512
9594186ef837cd2a6414f5e74b472ccbc82a1ee402db799478b154dd8f548ac7cb81ed331fd48efb27be8c4c059650d9e4a056b1515a21ea43f959fcae4fc386

Download Submit