3e7d74230afb014c17ab0b30688aceeac17c71318437f9673ea2ead4cf6e53ef

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37508364fe3686d0f27f727b58d09c50N.exe
Size

194KB
MD5

37508364fe3686d0f27f727b58d09c50
SHA1

426d999ff2e27dd1f3c3ecaaa36faf82a8ac67b1
SHA256

3e7d74230afb014c17ab0b30688aceeac17c71318437f9673ea2ead4cf6e53ef
SHA512

0389c0add09d541becf4c12efd168326434f6a4ba162569aeadc9033e2599ca9a68ae9ba614bc2999bf5c9b6b9316eb3ee3aff7d03282ba213a393300b76215e
SSDEEP

3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBJTzkS:RqKB+tOkWKR0iJ0lTzkS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2740) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jre7\lib\flavormap.properties.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll.tmp	37508364fe3686d0f27f727b58d09c50N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	37508364fe3686d0f27f727b58d09c50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37508364fe3686d0f27f727b58d09c50N.exe

C:\Users\Admin\AppData\Local\Temp\37508364fe3686d0f27f727b58d09c50N.exe
"C:\Users\Admin\AppData\Local\Temp\37508364fe3686d0f27f727b58d09c50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
194KB

MD5
d0bfcbbc569745ffade7bf1f716d1936

SHA1
124ea8cdc4bb46719a65b4666cc4f2c0daae945c

SHA256
2c819b9917925e164928c1728bb28c4aeeb4e515c690986cb93c526c6d24d14a

SHA512
59f84733f9a7e6c908341b6c0200395d0c6020116bad8c9caeedb4344dfb55b261efb7b784c3d7c8ac7685775fbca593ba64802bc559683a4673993d795c7e63

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
203KB

MD5
b42780f44ef9db0c39c07acb27b18ce9

SHA1
9943af75f9c0deb6468bf415083463d3535121a7

SHA256
c86dcb1d8e7dd79244843b1c875b7edd8ce34c02109cec7564746b72cb5c6ef3

SHA512
64597530ac333adf62ee9ae43ee3272189bc5696219fadada699e24edc0f0a5da24af756baf626bb97947cc9cd7b643eecc241c93b9df6f361d4e3c186656bfa

Download Submit