304a0450dab0193f243aeb1efdc09fe70e0b4abb6bac75ead0dc860c2bfe7bf7

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d31c936a3b5c73c8b7757446455953c0N.exe
Size

52KB
MD5

d31c936a3b5c73c8b7757446455953c0
SHA1

a8fbad138d710448c90c647ccf1f8642b73f5882
SHA256

304a0450dab0193f243aeb1efdc09fe70e0b4abb6bac75ead0dc860c2bfe7bf7
SHA512

202ef53a5810464d3716b056d540ca0cf2b31053ffb2ac3642db22f2a14d95533c6d5076654ff97a05334e1ba66988a6fffb507ce10d69c91edfd3b266f54906
SSDEEP

1536:W7ZppApBULcfpHLcfpyDoAI9yRYstRYsR:6pWpBwchcwDK9SYsLYsR

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Iqaluit.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jre7\bin\sunec.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Mozilla Firefox\application.ini.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Curacao.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Ojinaga.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Mozilla Firefox\platform.ini.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wake.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp	d31c936a3b5c73c8b7757446455953c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll.tmp	d31c936a3b5c73c8b7757446455953c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d31c936a3b5c73c8b7757446455953c0N.exe

C:\Users\Admin\AppData\Local\Temp\d31c936a3b5c73c8b7757446455953c0N.exe
"C:\Users\Admin\AppData\Local\Temp\d31c936a3b5c73c8b7757446455953c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
52KB

MD5
a1db8ba4bff614d482e56d5f110f3434

SHA1
68294280e89b8ba2fb63d6c18450295c50d7ff60

SHA256
2262d02aeb38553004cd1ea2eb0502b6515b190a1152a4dcbb323dd69efddafa

SHA512
c4d70f93c7590feadbb90615587e19e88c83bd12b49b100d61cd192aae930b8719b0467aad7b6966b8def24792883f48c4144233aeec841f052162d7aa05dd7e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
61KB

MD5
d6a8fb4276fcb5cecd19cfe0b6d928d1

SHA1
8f4191ef71706f280a975d2d6d93dbb4dc2d516b

SHA256
2f75a764ea719a7eeb614c6b630e1475fa32fdaa851454e06127af3661d96d9b

SHA512
72692a0bc8454c9a34a15bdb6a3d1cdb173c0bffb490a8cb1e59a4dd89f1b50e434825167236a20f3aa8f24df64d5320586f724391748c0bb4e8fa3b400bde67

Download Submit