347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
Size

46KB
MD5

d1b0fb49573516588757a261b453e68f
SHA1

840899f91e08f9e41f1c080cb1c0495aec93664a
SHA256

347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec
SHA512

374ffaf7f5bad6016315922e054bfce8795ea1fe45a6383fdd8a9b1c2d7cc3d306486d5cc33c2dc8eca26e8ae2150d37e3af2c0409d1b5b6eba5f5397b3526b9
SSDEEP

768:W7BlphA7pARFbhL801VvM801Vvv7GqSY8:W7ZhA7pApw03vR03v1SY8

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3791) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jre7\lib\security\local_policy.jar.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\3.png.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\micaut.dll.mui.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\VideoLAN\VLC\README.txt.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.bmp.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Windows Defender\MpSvc.dll.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jre7\bin\mlib_image.dll.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Windows Journal\jnwppr.dll.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_rest.png.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\gui\libqt_plugin.dll.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\currency.js.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\ConvertToInstall.hta.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Windows Journal\Templates\Seyes.jtp.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\UnpublishPing.mhtml.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe

C:\Users\Admin\AppData\Local\Temp\347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe
"C:\Users\Admin\AppData\Local\Temp\347527b64cc7105f45b50324a8db4411a33fe1ea75a5fcf1775cd8a09bd6c9ec.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
46KB

MD5
70a9f10a64aa46b6af6aacb303a8f777

SHA1
2a6e38860c285ab001489ab332fa85c44d674dec

SHA256
728946663eff38cfa316d8dab3407a4c131117d2b1ef8068d6acabd178057110

SHA512
84282cc65284ad22cc61d22d0eca3651024ec84493f86c872c46d6e9430494b4caf7a4160c846493780ae0d7e6fefda108d4f97435dec82204f5081fca59767e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
55KB

MD5
084f86bb73b79a2577704ca40f01adfe

SHA1
9b4a074f455be3bd95dc62f97de84d66f95c40bd

SHA256
4efedccb773b18d44a5301ae690bf37b5d407eb034c49aad1137c8992eb4f974

SHA512
dfe3565c1a28f32bcc6c8b7fbf199cfef540aace17c8d4098dcc1e137c1e3e106f15909d7dee457bbab9e5679e77ba8da22f63680b322c61f35b8f226ace2214

Download Submit