af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5a

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 09:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
Size

49KB
MD5

ab572ffe99c1e8d7613e4c0b570d8750
SHA1

1deb1ba29ba5a2fce01d40e2060d638cde8eb747
SHA256

af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5a
SHA512

4a0c6e993760ce62c9c7b5486bec1c5ba884d9123f47d2a43412334fdabaa1aba0194debf84f0453feeef6c109489bb649533dcd678d970ad136467f4c699024
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLUty6J2CzxJ2Czf:W7ZppApBULcfpHLcfpyD3tHRz

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3442) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jre7\lib\security\java.security.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jre7\bin\jli.dll.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jre7\bin\orbd.exe.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgRes.dll.mui.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository_1.2.100.v20131209-2144.jar.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mazatlan.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libfingerprinter_plugin.dll.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yerevan.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
File created	C:\Program Files\Java\jre7\lib\net.properties.tmp	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe

C:\Users\Admin\AppData\Local\Temp\af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe
"C:\Users\Admin\AppData\Local\Temp\af9e134cb333d7f9ec10eb6840d3e9701c9a462d6e81b2897732c5881064fd5aN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
49KB

MD5
9ee55b802088496e80a650ed8dd75d05

SHA1
9d46ec91b9a51f9e120ef3d8214615b15446d5f0

SHA256
e03c5cbbdb8874bb8d2c42496314f071559d812f82e1f194e5a618817330ae16

SHA512
8f31e858199336ea60775009ae9a5c0d1cd23ba681a9213b1ae708682a40123b8beac9885e16c49f39acc8fe0352b91359344a2ccae6ee235d40c335f6b287ef

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
3adf9fb9883050771f6d270a309dbaa7

SHA1
5dce59822938a7f629be0361a30622e753f501fe

SHA256
c61f585a288ec7f90d7f0f8b0da8417b316285d5bf51e773f6e1ca56416af0ea

SHA512
278046e87abb281db7c8302ca829da5ff7a9f81746dd99d385c6ec505a4f50fc5201279945c98129d7992a218e1f58abade7bcd5f12ffb525b3cf0133d30fa71

Download Submit