d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
Size

88KB
MD5

4e5b5ebb06a937100c91efaf6d7b0741
SHA1

1e8f55e05eb64244a16d8ffb6cbeea792e62a0be
SHA256

d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d
SHA512

7c3ffa6cd0b8dec91ccfe4e22788bb115ca61fecadc499a9dac3c474657d05a299363ccf99e9049101d61190629c618523d79d77dd5563fed07fb630fa12039f
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKggrXF:69WpQE0zxgZ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3485) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\ConvertToBackup.emf.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Microsoft Games\More Games\MoreGames.dll.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\info.png.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jre7\lib\charsets.jar.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawdv_plugin.dll.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\gadget.xml.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_ja_4.4.0.v20140623020002.jar.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Sidebar\settings.ini.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-hot.png.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Journal\it-IT\jnwdui.dll.mui.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Journal\PDIALOG.exe.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Mail\de-DE\msoeres.dll.mui.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_top.png.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\settings.js.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe

C:\Users\Admin\AppData\Local\Temp\d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe
"C:\Users\Admin\AppData\Local\Temp\d3cdcb34256b7f3378cf361d616b4cacf185ab654d91f863baa28a768f51327d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
89KB

MD5
56e239eff6ebbf322130129702099d2c

SHA1
025634caba785ac5e36b513297d1f164994d772f

SHA256
9da62732280715b3dcc388324f0b57fe2572d2c082b02dbfbb6db39564d7fb1c

SHA512
4b1fb4aabad4bdc31d650f00adcaf00ff06a0b6cdb862a1db90315bae0d8fed9ee80b070a3a74c01c393539d51d86838a0cfb1f6dbf47f288ae0ee2a6d6ddab9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
98KB

MD5
1c554a7d630d6705b6e79503eeacaf22

SHA1
1987a2c18b3bc6165e2d99b62c02526174429103

SHA256
218c36bb4bad586208afd1e015419ea98c4a8d34c8056944ab25d4f8743d187d

SHA512
f66d3e3e7348ac79fbae872b823cd0d84f701c33b29e545ed123fb28d147a3de3050a5d59a67d8506943036cf58b858c2503ab31a3d750ebfaafd16ccf038be4

Download Submit