48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
Size

91KB
MD5

525d87c6a2813dc051fb26bf460dbcc6
SHA1

ff238e721fc445d0181a1a5af3b29df2238d2d2f
SHA256

48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3
SHA512

09c13f152c11db4a3b3e46f16eeefa0e9898b8e9b7926df808440bf2eca4bf8b3f45be417016eeae69ab29ad45f95bfab2284a4948fb81e4d1d9bda8286ddf47
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEh4:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsZ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3570) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\47.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-dock.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseout.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\slideShow.js.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgzm.exe.mui.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgRes.dll.mui.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\EnterFind.vsw.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\logo.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_windy.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Mail\de-DE\WinMail.exe.mui.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Journal\it-IT\NBMapTIP.dll.mui.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\RSSFeeds.js.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_foggy.png.tmp	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe

C:\Users\Admin\AppData\Local\Temp\48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
"C:\Users\Admin\AppData\Local\Temp\48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
91KB

MD5
ce7b7e0a0d7dc8d46366a173045e99cd

SHA1
3dd6e3ed6081b8ec50b67d42b3924488b434333d

SHA256
325dabeb502fd9f90ecc70b28d756cc8ee462206abc51b2e52b246f879607fe9

SHA512
c24ed8b77431c5dce9e4f30f11c88aaeadd0fed20b8f2317100760299936abc93e7ccd2900fe0ea83964ea8b2463fa59b65ddbe23a62c0721886fdd09da60479

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
100KB

MD5
913f20f71902e3e214738816c548f05b

SHA1
6c0e7bc600865eb0ccb9956f22ed32e1905802fc

SHA256
f4ac0fc611f4cd122339b1db4e3148e8611b57c679ef78e51596df771d0f17b5

SHA512
1029b0665b2da1acf239ce96cc3dd693e90e476fb1cd71252d7596ac4bafc7000229b77c3e9bcc70a635a113f0ca69ce6792eb270f22a2815ffdfc0f2eb242b1

Download Submit