1f06200c38f9dcc096b0d31c6f607ae9b87463b349e79deabfd92a5ab1c2fe3b

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3f1e32eaa1a7567507717a01040de9d0N.exe
Size

60KB
MD5

3f1e32eaa1a7567507717a01040de9d0
SHA1

aa9cc9c4b7b766dae9feef8bdd73bb2663ebe53f
SHA256

1f06200c38f9dcc096b0d31c6f607ae9b87463b349e79deabfd92a5ab1c2fe3b
SHA512

d4ceaa42320956dac8e1472268f3f215f7ea2c6ae15a4662e2291637ede4c99c0669aa5172f67e4c545b08c0181d239f7b451edc8115579414de49db440d90d7
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/U:W7ZppApBULcfpHLcfpX2/Nw/NwmxH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-loaders.jar.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Perth.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jre7\bin\ssvagent.exe.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\ProtectDisable.gif.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Internet Explorer\jsdbgui.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	3f1e32eaa1a7567507717a01040de9d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f1e32eaa1a7567507717a01040de9d0N.exe

C:\Users\Admin\AppData\Local\Temp\3f1e32eaa1a7567507717a01040de9d0N.exe
"C:\Users\Admin\AppData\Local\Temp\3f1e32eaa1a7567507717a01040de9d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
61KB

MD5
a858f7411eb55676fdf961836a9b85b1

SHA1
30b4595f24d800354b34350cc82071a9e3f174e5

SHA256
c2547d6772827bad58b44bb3bb88d4abca75fd8ae71e75c6c0d9ac1624fadca0

SHA512
433bedafb5bd3e3be3fa62c358b32a6e2a4491bccc7395044974043ff06612da4426d9c0e46affebb3f6e55b54d02f6078cd5979dab22881bb9d1052652b2a8d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
70KB

MD5
d05525b7e9ce3f458f1ed1bff831672f

SHA1
ef4fdab806b0163da660f9d36b6e0c9df1050d6e

SHA256
c19f5de5e48cb57f869baa901ec6eba50842403c82f5f7409e1fe89e0c89493e

SHA512
45f3e8c87bdb55ffef57391fde27b0419d660b44ae31aab2bddd6fe931ae59c5917998af3798ccd6bccede8b07054f27de9ad5d66de57ef853ebd44be7986080

Download Submit