e8a2afa156977c056f2ea6f6f736405e0f135c8f7c181acbf2d8cd23ce87e308

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3b911112f0961989b22cfc6a9ba9c20N.exe
Size

66KB
MD5

a3b911112f0961989b22cfc6a9ba9c20
SHA1

40d4dda40b4a2355cb49d93c4a312c3a98c8ad95
SHA256

e8a2afa156977c056f2ea6f6f736405e0f135c8f7c181acbf2d8cd23ce87e308
SHA512

c6d53b0aa770467421fb30e34a9227bd8b94a8fa36de7728a2bb9a3ec482cdd12f2bfe585966dfcd616f19ad8c387fcd949e69f852ccc85f7a8a47724c368b24
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/U:W7ZppApBULcfpHLcfpX2/Nw/Nwmx/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3205) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsFormsIntegration.resources.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qatar.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.png.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guyana.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp	a3b911112f0961989b22cfc6a9ba9c20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3b911112f0961989b22cfc6a9ba9c20N.exe

C:\Users\Admin\AppData\Local\Temp\a3b911112f0961989b22cfc6a9ba9c20N.exe
"C:\Users\Admin\AppData\Local\Temp\a3b911112f0961989b22cfc6a9ba9c20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
66KB

MD5
93b86a163118b4a7b0173553057d15bf

SHA1
0436b8398689e4d5ded045c2a3330a5ebe330efe

SHA256
fcbb2c90103398463e551d182d980df19ba986d3baf1104f0fdbe1e19b092138

SHA512
cc5a0fba4c71f868101d3ce51c3646f4f8c0e5ec4ca2d7e488208dee42b2e35748a100823426428b701a3f4f0643303bc8d0898ba5081abac673d74ba4d90ee5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
75KB

MD5
696958179203e2928d7fcdc1dfc75864

SHA1
d00f6cb797eb4a229e8d166f3992aca1deeddcb4

SHA256
2248a1ab35af9f4a18a4dc09def6b4f3cd59611a18907d7d2f099076daa20ec0

SHA512
7d38baf6af9a12785533a62b8e0dded2d0e345448bea346d8207ae5e439f17ddeed2672c77eb8c5255db9690cb53e4523c41844f2272ce5351b3d10c11b1a5be

Download Submit