d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
Size

35KB
MD5

fce922c2b253f59d5bbfc73d9571aa60
SHA1

b8bcb36f2e37a0f0f45ecb6b493932af5f3ab97c
SHA256

d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9
SHA512

5003e1dcfb7f0e062d58f9bc7410030d560fce883afdf9ef66f50b208a4bd86a826da3833b6f6b5dc6f282ac6cd252691ce9f961af71ed87fe07d2c88c6dc284
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltg:W7ZhA7pApM21LOA1LOl6Ag

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3105) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nome.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Catamarca.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jre7\bin\policytool.exe.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\HST.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Java\jre7\bin\javafx-font.dll.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe

C:\Users\Admin\AppData\Local\Temp\d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe
"C:\Users\Admin\AppData\Local\Temp\d35f277cde36e5a9f767cd50b733d4c4446e5e820d31e5b66194f400a4affac9N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
35KB

MD5
1f539385cab3c43442282c3365c70750

SHA1
34a928a3ccd9cdf9844b0dfb395dec6b6058dbc1

SHA256
ed2681ecb994ca00ba7cc523012955b67d60acb4f497128f20c3f74d2eafbeb9

SHA512
f7445bb77bb9d2084b88d82daf7c4666c00bddfc5046a41ebc2d46491f3f0a249223d38ff2a93ae4499abf4668ef065f2707b1be88dd754248412416d11c792b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
44KB

MD5
e6596583615ebcccfb30eac45b8656f2

SHA1
74b7bc8522149fd03f0f4f61ed36244b3cfae04f

SHA256
5d4e3891c0a9eebdff8c40fbbeffc0fc0cd67b4874d5d0dd2916d9776dfd8428

SHA512
cf6d7483e907b9e837f30d96bb0be2d48c5839035433a3ff7d7922cbf4abcd2f4d180181cab986a7ce37e1c5adbf947350553b51449038bca20ec983fce0fe8e

Download Submit