3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
Size

38KB
MD5

b60a94dbe886161fced9693b4c331a70
SHA1

305e662e530caac532264898f8dc755b4bd1d863
SHA256

3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377
SHA512

135360e2162a1de66c03a236782c22fa8ea59130146d3625476164d15637321624fff16b06a645d31df3f6f6eebfcc9cd72bf0dfde549bcadc044965cb3a575b
SSDEEP

192:tACUADIY0Br5xjL/nznlAgAQmP1oynLb22vtI0zWXPXUXHz9g5JHz9g5Dabb4:GBt7Br5xjL7lAgA71Fbhvt3bu5c5D/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3285) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre7\lib\javafx.properties.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Efate.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Mozilla Firefox\locale.ini.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\splash.gif.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe

C:\Users\Admin\AppData\Local\Temp\3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe
"C:\Users\Admin\AppData\Local\Temp\3db626b1223b208ca7df8fdae16814509e415b6c4227de11826c24bab0ea1377N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
38KB

MD5
4208ac8ab9894dc77158840253e906ce

SHA1
691b7b8564d59062b3c1428234b1784c0b691e76

SHA256
4e2529664bd1126834f09709c66a6d6666b18a55f2b48be832e406c03cf0d3c9

SHA512
8790848cf165466747ea4038cc8ca0bc95e0ebbeca793acf13c96015a7a5ce4d79111fc6cf3c6a1d35a26e6acd7dff4f1f6867abad0ca64a0cb227097f72b892

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
47KB

MD5
5abc34afbbb54408ab4fc7b6ad8df769

SHA1
048c4e1aaef2cbf78543cca8636f6c48442e60bd

SHA256
91dbab6ac736ed3d5c82f360643ab81c9fb50e4887e0ac511d23bf041c4ca2b4

SHA512
c4706ddb7697dd228bd95516b1479ceb56f672b4b222e7dcdc9c8d37ed7f37c2901e79296f37fde19e569e71c330c752bb94491472454b3b92190d90ecf70fda

Download Submit