46912a80df85547cd4e0bdb51a3a8befea752b8c847cd7e548e4f9c89df2f542

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3150e99f43daa042f550977603cc2040N.exe
Size

62KB
MD5

3150e99f43daa042f550977603cc2040
SHA1

b195a0d739d7268e243fe2d1b8aae0cf212c15e8
SHA256

46912a80df85547cd4e0bdb51a3a8befea752b8c847cd7e548e4f9c89df2f542
SHA512

b002aada3ce95b873146021168031abe8b5576d1b7058cf7789d1b019919e981ba7bdd4e2987f1d399863164a627b43a32bbd0f7e6bf7ebb654d27da93878272
SSDEEP

1536:W7ZppApkxUYU30NQn0NQaYioumdGwmdG8:6pWpkc0NQn0NQq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3154) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Mozilla Firefox\dependentlibs.list.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\release.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\librist_plugin.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jre7\bin\jsoundds.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Hobart.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.sig.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp	3150e99f43daa042f550977603cc2040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau.tmp	3150e99f43daa042f550977603cc2040N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3150e99f43daa042f550977603cc2040N.exe

C:\Users\Admin\AppData\Local\Temp\3150e99f43daa042f550977603cc2040N.exe
"C:\Users\Admin\AppData\Local\Temp\3150e99f43daa042f550977603cc2040N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
62KB

MD5
414cd1d779f17952cf1200889199bdd1

SHA1
fdcc6b0c9c4744fd6b402a61941f31c8467bae05

SHA256
600807c8663008a23ea2d54669009f56346b4f3ab4c7d072f50ebd4ebfa2f23d

SHA512
bd806f36de468721fcc0b2a640a297fed705e1e30328059c169cbf7095a5afd135501acaea3032102a052ca46123dab0034fbcb00842156d5bc19c286ac7c46a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
71KB

MD5
7323e5912704478d64d56d59d1888da1

SHA1
f4395db991104989b8043adca93e6e6dc7bad6f6

SHA256
91fe4c64bd6033ca0f56b5d09700326af1cdd16e2a4defd80a047f9aa8da76d0

SHA512
cb271bfbd8c6c2fb4c54a6e1af832005a66e27110bc9a1a29622cd324bce53eb5b67b25e586973df30e55ca18d659fcad13952b17d949cc4a6dd71311382de81

Download Submit