39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfa

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
Size

82KB
MD5

e4eb8649059236ca1f5b58f13c9bf600
SHA1

dfff875006c74fa18e322ddf2b1eef53f313f466
SHA256

39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfa
SHA512

8f0976302b5e3a9360a4ba63f9a91009bb0beab2d8200bca61037dfd005f91c94171db6a911650af25a602f38d0fbd9c30a20a3fc6fe4676490af716c0dca6a8
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYs:6e7WpMaxeb0CYJ97lEYNR73e+eGG7

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3165) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jre7\bin\ssv.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgRes.dll.mui.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Maldives.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\VideoLAN\VLC\New_Skins.url.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Java\jre7\lib\resources.jar.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe

C:\Users\Admin\AppData\Local\Temp\39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe
"C:\Users\Admin\AppData\Local\Temp\39fc3bab61b5611051917c19a5aab80d60a6ede35fce16fdd0ca3c67416e4cfaN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
82KB

MD5
b715960082cbbf62a4d580a3a25b7d95

SHA1
4528418b2fe48684861659c1f42fb70778b6f2b5

SHA256
6a3ef7e37eb745b02f16fe50a667246a166283d85c796115fbf8ec08d9ebf03d

SHA512
199497e9fa74661a5d93e94e475bfa9c9b8e9ce9c3d3070a8d6d517e07af87891515ee7d7e51e0cdd04ac5070140ef5b29befdf417ad5c629219fdcbd8d00911

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
91KB

MD5
a00cf372d7b470cfb9ff238a5edbaead

SHA1
7df3a1dda5b7994421fe75d9300ebf2c703b5ea3

SHA256
194df20f740592443d7f8458ae4f7861b17bab8440a0d875818318c6a317614e

SHA512
93d1c9b360f4ea65659169bdbf945177c3d1fb3c9dd97f0bf1c4965596678e98f571d9760001116ed4ebb0ab71e9e68163e096fdbf0cde4ad2f2293f9b954bae

Download Submit