af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
Size

56KB
MD5

09f23aff2c768691890cbb5ed13544be
SHA1

9f9026e2b7ad7413d1d193a5fac330107a799c7e
SHA256

af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea
SHA512

4c4a897e75eb982111553c935c33e7f8243717e98f27a560fb34ddddc2066281f244afaafeab2d24de836c417f0effb954b42c2557b431c380e231bf1a2dffa0
SSDEEP

768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJWX0kXX0krDzgpQZ+zzgpQZ+lb+kbM:W7ZppApkGpaI4lykyr

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3682) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\currency.js.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseout.png.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jre7\lib\zi\PST8PDT.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Mozilla Firefox\mozavutil.dll.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-vertical.png.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tarawa.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_left.png.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\cpu.js.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Mail\es-ES\msoeres.dll.mui.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\settings.css.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jre7\lib\logging.properties.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Microsoft Office\Office14\Custom.propdesc.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\slideShow.html.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe

C:\Users\Admin\AppData\Local\Temp\af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe
"C:\Users\Admin\AppData\Local\Temp\af7ac8ebf2bcb4a7c1308ec48837f478e3c83b8a62b1b74b342800d5241daaea.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
56KB

MD5
6647b644e67800a8aae6815a6ed3b7f2

SHA1
40d5278c0311be7a3a715a665d68b4fd5379cb71

SHA256
d8859bebdc8cabb0d2a5cb756f38c27523e660987a525ff386ab29f8ec83900f

SHA512
3bbe9c546811adb42f7f7702b2d8b1f2d77e14aa385448d7d268629b9cfbed1e96e2d78bd617219a179cbdae9741c90bb062c37ddeee125876c103fd50bba770

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
65KB

MD5
3a9ce56182079504776f4298dd91f9d4

SHA1
7b1426d4a7e3e954a59db220a11c608cc5046596

SHA256
92d83c50c72f05ecc64e7e49f8d94a8af604634d5b7b2072c6aaf5160affb319

SHA512
f4339fd377b50250b59147d7bd1434f961de9bba2d412aa64804d9c59e97adfacd29c4ce8532838f5d6d5231da6cbd6474a24ef61f7b4bda3fc21ac9eae4bcc6

Download Submit