3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
Size

36KB
MD5

012ee7633c6c96cc4b36ea5fffa75e98
SHA1

62afbc920ad31f37509a1c2654b10003b27a10a2
SHA256

3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b
SHA512

7343e7d18b2b2a0242d6f35dd8931b2ca0378de9d1d42889346d23ff182b415ee4bb9ebe3a61ee3f9aff8acb4732b285495256ab1ea51939910e41c3a59ce5c7
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHhpqW7U7OlI2v2pdM:yBs7Br5xjL8AgA71FbhvszwU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3733) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.PNG.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Windows Defender\MpAsDesc.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jre7\bin\jdwp.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\ReadEnter.AAC.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\timeZones.js.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Adak.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Xml.Linq.Resources.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_cycle_plugin.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnscfg.exe.mui.tmp	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe

C:\Users\Admin\AppData\Local\Temp\3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe
"C:\Users\Admin\AppData\Local\Temp\3372dba984e3d12cf325e7ce1f608f3ecf41c3364a70d64a3e52fe19388e903b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
36KB

MD5
a26a1304066cbd06f84d737bc215f99b

SHA1
e3a17f56f533f4dbf3dd0171ed284a8a3a3c6085

SHA256
fa0226bd86397e67db88853768c7f69ac70a41d37c0ac909a998c6a7762df6ce

SHA512
7d9f917ddfc9b81d691b89ac76d9357a988d226a968ff6beaa9df91c4f390b3d033e91208cc45c182859154104dc986b047a7e6450265abc14498e618e5fee2b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
45KB

MD5
def532fa810c4f333c086461018c7304

SHA1
2a816c0c1ee0006a712791668ea1bd58ab6067f8

SHA256
340ea31f8d94a13ae6134777db93be110fc25f349d02ba79225f232febac8bcc

SHA512
03a81e89576d0eb5fcbd68d74c927e4319ae4b97d5aa3eb5a069059589835d75f9a607832a2458225b0e5b8cd8f6e2894727566a7f9f1bf3300056a222c11cac

Download Submit
memory/3024-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3024-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download