b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
Size

64KB
MD5

4eb46abdd112f067937cd55627916ae3
SHA1

f1f965c28b705e8ff4ed6135edc2f6025be9a860
SHA256

b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6
SHA512

15c35e5fa0cf2d9e52fc753faaa4e284c0e460f584f42bd834db9f9676cbe673f8d406e2a3103721dea4f7f12e944be4b2148b7e5d28e49a909780afe002813a
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/g:W7ZppApBULcfpHLcfpX2/Nw/NwmxD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3433) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre7\bin\zip.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Chagos.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Windows Journal\Templates\Seyes.jtp.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Windows Mail\ja-JP\WinMail.exe.mui.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Windows NT\Accessories\WordpadFilter.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre7\bin\policytool.exe.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Martinique.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe

C:\Users\Admin\AppData\Local\Temp\b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
"C:\Users\Admin\AppData\Local\Temp\b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
65KB

MD5
782159b41ba4bb1da141bed1f5df7c62

SHA1
ea7aa8c2b2d9bf61aa5d61f27a13170b12d136b2

SHA256
2baedbc10f8163b37c67cf8b5b806d07acfc4b449a33a56dd5182e092958b624

SHA512
1ce1bc59d863c5e2aafb297710e88dd9cd1ba189bf500f621c04a7957cd6855d86cbdcba937ad7d5cca534f9772554d8613d4fe3eca6ab57986d6e8bffeffd1d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
73KB

MD5
b98076ad2598e34729beb3c6387d2903

SHA1
4d1c897fd9223c3acdc93c4009581e50bab1c1c5

SHA256
910e53d49ac167788c9cdf377a443414df6378959eac0487f5a21cc20b98e7c5

SHA512
9e4d30e9b4fda607151e77f7c4ff454e4cac991b9d37e8889bda5f097dd69b346e66b3105049c4df93120cfd03ff3008a3dbc316df550c5ecee2ab0f4c92e156

Download Submit