317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
Size

51KB
MD5

6c9e8cbcbd9f9302f597fe0cc10a05e8
SHA1

bfe52a05dd8af0c74fa412b0170adc3b917a852d
SHA256

317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84
SHA512

6fd3836af2c3988583f3ccd69325ca03e737d764a86ad3c691397417235593219f124056ea12e7f70f3fc7498984553d934482463726e40474c2c0f2c5055887
SSDEEP

768:W7Blp2sspARFbh5YSfff9n1oXKCqzEIn1oXKCqzE1IwScIwSWF/MF/y:W7Z2sspAp5YSfffMrfr92a

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3678) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Windows Media Player\mpvis.DLL.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Windows Journal\PDIALOG.exe.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tunis.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\ResetConvertFrom.mpeg3.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libinflate_plugin.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Windows Media Player\ja-JP\WMPDMCCore.dll.mui.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Chagos.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Windows Media Player\fr-FR\WMPSideShowGadget.exe.mui.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\clock.html.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg.png.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe

C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
"C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
51KB

MD5
d64503e6e13b241b83e48057e1d37a5c

SHA1
9ad94341f36456aa8ac0954dfb51f45d48b741b2

SHA256
4dec3eed98495baa23d24c58389a708ec86f8d5282de6494d08d6a6d3e15c009

SHA512
cecd0565e8765ef4a58ad9944fd9b8dabdfe3ba7974cf0e868ae891c7c74e66940597a3cb8738c030407b00ca4b874e8e61dc2936d91fb0e0e7a6346dd877f28

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
60KB

MD5
5bbb5478b85766e8d18544df5df424c9

SHA1
29980ff8cb30e9aa5cd5574e8f8ea2a1b85f9686

SHA256
c3e318c081da3111f295b51b9e053ddb97499a60938871b8691b5851bcf9ca18

SHA512
da965d995f634f68d7f8399db8f6a06961229370555631da16e53f75df04863cc6085d5fc3927de6b4e00e8e2a5661748176408657a8706ae758ccc9952c68a6

Download Submit