c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
Size

91KB
MD5

8a694cfafdede3e073f0e9dc63a8742f
SHA1

9622459d5ccb60081ce4361b6d9c6d4870a247f4
SHA256

c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588
SHA512

6d66f1e8d64ff898bf17de977dd7046a375f1d69b3077639698af39094964b84486192128dc60a7beea27ac734196e3653dc2359c089a0a29c6ffec43cfac81f
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKgg+EvBnHHwTVEvBnHHwTB///O:69WpQE0zxg+TPnO

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3684) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\highDpiImageSwap.js.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Defender\MpCommu.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Mail\en-US\WinMail.exe.mui.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_On.png.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libstats_plugin.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.bmp.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\connectionmanager_dmr.xml.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext.png.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent.png.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_ja_4.4.0.v20140623020002.jar.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\currency.js.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Internet Explorer\jsdbgui.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Xml.Linq.Resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Vancouver.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPSideShowGadget.exe.mui.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe

C:\Users\Admin\AppData\Local\Temp\c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
"C:\Users\Admin\AppData\Local\Temp\c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
91KB

MD5
04dbc05ecf9df35cd9c5a1b13b1d062c

SHA1
94b198d117ce3042a167a8f3f44d5042077e0e0a

SHA256
15eb8f88d37c8abdf5c33e0712fe2eacbeceee002b164209668c7ec1ed207fa5

SHA512
6208bf1ac8ab33906a6e880c43e1160ae86f0be25761bd7fc2340e60e4abd3b988b46fbd7a39bb4b5e800101e5296436cabd62ad64e7833031f9b4165ad3fb71

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
100KB

MD5
2a43788ed91ed43bae96663867b36c6c

SHA1
c5827db1870da4d144b815b6277fc618125af2f0

SHA256
c9ce026e77e97f2ca4bc38064a669eb24f1db7f34e854309c4c45619fb53d31d

SHA512
09f8c132687bde9e202e220d587f2a69fd45b5bf33a53540409c8cc3a81604cb2bd073574cf01aa2d5226111734156d6d999baaa10561ead01e6d28eb52ff854

Download Submit