c216d5346bfed8c9e76fd77d23b0c3a6431febae4a790a5fa978a71a60d0b51d

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31bd4405efacfae31a024b9b69a12490N.exe
Size

47KB
MD5

31bd4405efacfae31a024b9b69a12490
SHA1

8e541b71e3ebc145c1b5cf2afee267559f64e218
SHA256

c216d5346bfed8c9e76fd77d23b0c3a6431febae4a790a5fa978a71a60d0b51d
SHA512

891cb53311f107ad5df7b32be90e7cab0c14aa2e84dd82ba8cd0bfde9bf90840bfa9c922c3b7649707448288f7da55e8f128b26739c05cdb6cb94053cbe6314a
SSDEEP

384:yBs7Br5xjL8AgA71FbhvBfepj3cfepj3KtLJSl2nAzKvDxl2nAzKvDgl:/7BlpQpARFbhq1K7nAkDanAkDg

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novokuznetsk.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_ja.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jre7\bin\nio.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Games\Chess\en-US\Chess.exe.mui.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Whitehorse.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo.tmp	31bd4405efacfae31a024b9b69a12490N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31bd4405efacfae31a024b9b69a12490N.exe

C:\Users\Admin\AppData\Local\Temp\31bd4405efacfae31a024b9b69a12490N.exe
"C:\Users\Admin\AppData\Local\Temp\31bd4405efacfae31a024b9b69a12490N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
48KB

MD5
c40617f671181852f1064943a06f0ba3

SHA1
96cc7322b02839a6d1c53e505b1a19836be3dc7a

SHA256
3b3c731bc8cd535e0799b12a76f56b42ddcba779f66bd34b1091d56f7c210758

SHA512
c40cea8916ce394c63c60735ab4813966ecbfbf5cb46be07eba5f5a933e732299a9ec5f94f1989a411efb6f4f767e732eabef21acac09a9f7b51d4c72850a8be

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
9d88768d29ebae5b8a25bac47b2a6c41

SHA1
22f9cbce434c07d6a3fff32fb46c1991faa927fb

SHA256
0d88e6439515187e971fd71f79d410307b30543096bd46715549c21ddf5c2981

SHA512
14de82b531901718ae9cd98a1efc49e849e69aa2fb049b3af46cb2f7bd1c9865c419c73da2a7b7d5e6f160ab35b18646484f277090ab64e14f8852025b1b6d1a

Download Submit
memory/1908-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1908-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download