caa8605f91e11fa97866de898432330fbab4e640fe192fa2a6f28ab223d77b96

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ed030e6b28edd44a7013f521c8decd0N.exe
Size

75KB
MD5

3ed030e6b28edd44a7013f521c8decd0
SHA1

66d0006410ba7081548a6d7c6861df01494c762e
SHA256

caa8605f91e11fa97866de898432330fbab4e640fe192fa2a6f28ab223d77b96
SHA512

9ac667f826b98afae0e989386b1a68fc262756e7f9d9867810046cdf7f2fd20fdd567c96de498327da0ee49f98ad8be096c3a07fb2bb11ae7c6a6ff5098df9b7
SSDEEP

384:GBt7Br5xjL9A7AgA71FbhvnwR/s4NW2sl4c3KbsvrTgOzkJAopyVFlgLfQf+PZfW:W7BlphA7pARFbhM0KW2s9B4hofAe

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3228) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jre7\bin\orbd.exe.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\ResumeReceive.wmf.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Lima.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\VideoLAN\VLC\axvlc.dll.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\chkrzm.exe.mui.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guyana.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll.tmp	3ed030e6b28edd44a7013f521c8decd0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ed030e6b28edd44a7013f521c8decd0N.exe

C:\Users\Admin\AppData\Local\Temp\3ed030e6b28edd44a7013f521c8decd0N.exe
"C:\Users\Admin\AppData\Local\Temp\3ed030e6b28edd44a7013f521c8decd0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
76KB

MD5
2cccc7c848c24c8dd584f1c64227120f

SHA1
572d3fe9a068c8e8993c3675b2269c56c5062474

SHA256
6fa67a357a3462e14d7eab0ddf0075ffb0125194c35dfdd7cc05088417834990

SHA512
3c2b1834adc07a005c015e362d034a856eb843d295d2f606f7161731864a75d1307f5368b1fe6d4930976b5e2b51c7ffc53519e4ac907c80162cd8d6e6d7e2a0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
84KB

MD5
8a95449690b87dcfc7a78909d682e96a

SHA1
08f4103fca6b7fc44eb5fcd9bc5585690a327ff9

SHA256
799c817a8c1037c252e684de8841dd48dabc54504ceede499407ca557aea953f

SHA512
51963a2f9c403cf239d50ec95558148b47610c7dc4c1851e9df7f4d7d1658c17918b92b9c96cc8d1a70ee433cbaf16b99661bef223dee99e08294c24f5dbe226

Download Submit