3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 20:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
Size

61KB
MD5

78b1a64e0ff2742a6fdd49ad9bb9ce78
SHA1

a4302ae3557642b105c31d0a0fb57d1089bf6516
SHA256

3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d
SHA512

330083006919afe31e074d99c49e63eaaa5e18f5a88506fc434751f4e5fdfcc422e6ffa68ac153b198786d7bf8ff49792291cad5708193d6845ca1ead529ecdf
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBk:/7ZQpApze+eJfFpsJOfFpsJ5Dc

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3548) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_s.png.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous.png.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yerevan.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\flyout.html.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jre7\lib\jvm.hprof.txt.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseout.png.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_nv12_plugin.dll.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.png.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Windows Journal\jnwppr.dll.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Beirut.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\cpu.css.tmp	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe

C:\Users\Admin\AppData\Local\Temp\3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe
"C:\Users\Admin\AppData\Local\Temp\3604e6032ec23efc049dbbe619c6d19102c475c4f33988db55e291e408588b8d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
62KB

MD5
ce5e52f294e2691125784487b6c6e0d9

SHA1
f6257343d53c7573abb0f941136d061f472dba0d

SHA256
3846aef98703a22dfaf079e577ac10b6225a216b3f3abd0a436b25655185addd

SHA512
b6a497ffb9607c3ded0e0410563aff6cfc6106c54dea944277c096f3cc4296515300123b4e2f9eeff2a8eceefcb19ff5d8862cacedceb1ae95ba5f9b2cb0dc35

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
71KB

MD5
46fdcfe4b86a112a6c8e4b77cecee566

SHA1
5b921a818a337ea9141488070d5172163506bc1d

SHA256
0a3f9d597eb01ad112153a0b1e09d2ee98259f91eda634134148c4962a4ca6df

SHA512
632a4f1ef7590c4b536cecc474ab2b52439d934300e9143c110042bbc901990d1c7cff2326df4af40231226d370ea4ced87c15cb3572b892412efa06cf191916

Download Submit
memory/1820-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download