4b9e1ebc9481801f28827db119ebcd760855cf1ebba020a9ad6cdbc469c03bf8

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3545787b45cbe2321eceb4618815d560N.exe
Size

86KB
MD5

3545787b45cbe2321eceb4618815d560
SHA1

f54e1abb161645447de11f09b0398314ee51fc55
SHA256

4b9e1ebc9481801f28827db119ebcd760855cf1ebba020a9ad6cdbc469c03bf8
SHA512

9d9bccb00fd4efc32b6120872a9e4e19ca337e2aa15edb29b824690271c2e58853a9f2ad6de97adf2896e96891003243d94e11bbffc465eb61d01f07ebad929f
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWX:6e7WpMaxeb0CYJ97lEYNR73e+eBSWX

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3066) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jre7\bin\pack200.exe.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yakutat.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	3545787b45cbe2321eceb4618815d560N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	3545787b45cbe2321eceb4618815d560N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3545787b45cbe2321eceb4618815d560N.exe

C:\Users\Admin\AppData\Local\Temp\3545787b45cbe2321eceb4618815d560N.exe
"C:\Users\Admin\AppData\Local\Temp\3545787b45cbe2321eceb4618815d560N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
87KB

MD5
844a909bc98cae8407c877ead33ce171

SHA1
a59a698056eefaa853f3f21da397f142a0b01bfe

SHA256
f6e3869d6f06dc3bee350e4eb43f4e8afaf48b997dee5eac607c46b0e28517cd

SHA512
ee518d76b471621718b6ee1f259841ee65f60a0598a6a500c5446aea2c8f204792a1d92069952b7fa75c9c5b9f60714daab420ec4759ffbc6a57de3fab3d7f88

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
96KB

MD5
c783124b3929cacaff4aa9afaa0e9241

SHA1
d9dabf8bb5090efe496c84faa583430bba68e624

SHA256
fa043150fa3e107cdfc9ad9ab5530afcd427e69c62c108d82fba51429ecc08c3

SHA512
ae02818ac08cb9422e8c8aeb0632568c622b89df972ed3ecb884cdf9e838d96549d1b989d07d9a01a8a97de8d9c002475af8234fe9517fc3ad0965834a785b32

Download Submit