169f417bbe8ee8e75fdf0cb6689bb389403052e14840f31575da468d417d90ae

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b424ac98c1426db46efdee24aeb9580N.exe
Size

87KB
MD5

3b424ac98c1426db46efdee24aeb9580
SHA1

8f440d4993bff12aa554422aac6e7026435605e5
SHA256

169f417bbe8ee8e75fdf0cb6689bb389403052e14840f31575da468d417d90ae
SHA512

c0c7bc0c90cd203779b8fec7988225566cc6e1f7583023600afd93b11b1724d7475df6a230a45eb290195cbb03337acc3a219745ea8249ddfdf7c7370e143cfc
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYY:6e7WpMaxeb0CYJ97lEYNR73e+eGGb

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3150) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chihuahua.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\UnblockConfirm.vsd.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsFormsIntegration.resources.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	3b424ac98c1426db46efdee24aeb9580N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	3b424ac98c1426db46efdee24aeb9580N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b424ac98c1426db46efdee24aeb9580N.exe

C:\Users\Admin\AppData\Local\Temp\3b424ac98c1426db46efdee24aeb9580N.exe
"C:\Users\Admin\AppData\Local\Temp\3b424ac98c1426db46efdee24aeb9580N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
87KB

MD5
c4236eb18076ec103a8445242f258a10

SHA1
2458a288b128f1f173a802146093407801fc0508

SHA256
768b2953c682b0722fce6906ca1d7a2e09e74a1e9007b7645bc5e05316501920

SHA512
6ae5c731761f21a4af3f7a658ba25751126a6d7fb56995278f2610ff8eba4acc72ce645e74e4ddd586e0068bcf7b54ac168c4b5f876198e5da7becc3d4788a1f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
96KB

MD5
5afc72338e2811097a7ae3ade304e15b

SHA1
baa7e559b5065a4690c6de35e397744b3ccae733

SHA256
385f9d296a3406c2b7efdca2bbadfdcb1f845279fb3e3b7caf92c3e96c42fdfb

SHA512
2d4ee185a97e0b71c7b13c70f59bcdd274552e28999311df6283fbe4975a8d45b365f7921152b3b8b4ab66a027c07a105356d8fa4dc678c2c5c7722a55a1451d

Download Submit