b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
Size

56KB
MD5

c1eac3c43e167ce32589afbc7823d7d3
SHA1

0da7e1db3a727f63c1affa0523c745e7a704b38a
SHA256

b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52
SHA512

718f3c94d83ac80339cf5261cd5489155fa32e251b5418eb044242a3203e8f4768ec516a63927d5ef9c61fb5e6418c9ab167434002619fb82a2f3b16bafc9f80
SSDEEP

384:GBt7Br5xjL9AgA71Fbhv7bhvo42L5FgAytBc:W7BlpppARFbhjbhg42Lcfc

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3761) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)greenStateIcon.png.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\flyout.css.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-left.png.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-windows.jar.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-3.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgRes.dll.mui.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\calendar.js.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\slideShow.js.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Windows NT\Accessories\fr-FR\wordpad.exe.mui.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Windows Sidebar\wlsrvc.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\HxRuntime.HxS.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe

C:\Users\Admin\AppData\Local\Temp\b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe
"C:\Users\Admin\AppData\Local\Temp\b3563f99a3ed907cede37b624805c178e69a9230b4fa583e4446198b7aec0a52.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
56KB

MD5
e4ca6adf0b13c35af79821bbe1a9bb05

SHA1
d14eca23aa86f1e18b5adc469252e804db38aaf1

SHA256
0cce5a10a1758ac38af5a6910948333bdff31659abd7cdc5a94ac4743bc2df2e

SHA512
c81407f62259f610379eaf6270e0408657a9587ef331b3575e8b0e73ad07f11e44472938e30f0ede9b1030c826a7b8b6b0b93942a01ac5350fcb3f8ecd3bde7a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
65KB

MD5
96be894bc6aa7e858dea6b9ad965e406

SHA1
21de1d3a482435c046a70b21fa5301740fd70193

SHA256
dd856afe4d287f3330ab4bf975fb24351df1fd419ddc2596de4ac97f513cb623

SHA512
a384f05bed0009c82c333a552c642978b452ce07f2226379c58e3d63777c83497f78af013ab97ed38cc1acd62228e858848fcad4d9d04821b7e12cfc2654d973

Download Submit