3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
Size

110KB
MD5

cceca70f454acfe7394ac27f6291b600
SHA1

541159017e437ee16b0266e557bc78cf98702a80
SHA256

3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43
SHA512

62172010c7a7aba89433fe87bc5593e0a45066ccb538cf252e3ceb7dcfeb9c1c4049fc04c76afdddd30a07ca43104afe7695b2a5fc06135b00b7c2950bfde60c
SSDEEP

1536:W7ZhA7pApH9QHwtRF9ESWu0SWutlggalggEpVp+ESIXosbosz1vKX/8KX/G:6e7WpHIyRF9ESWu0SWuDmmSIjXT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2919) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\de-DE\Mahjong.exe.mui.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.dll.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Windows.Presentation.resources.dll.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6CDT.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\FormatResume.jpg.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
File created	C:\Program Files\RedoPush.tif.tmp	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe

C:\Users\Admin\AppData\Local\Temp\3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe
"C:\Users\Admin\AppData\Local\Temp\3814aff97f07e2ddf38befb5ebe00aabe2e1bc44a551d13b0cec18e585d9ad43N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
111KB

MD5
bef0aaaffb4f6b67553480b64b44325e

SHA1
4bade4610f9a02e1fbb15d9d4ed80a2016852e12

SHA256
0a8dcc5252dc6b5cfcd6d8a75a6df1a41afd930a8f65481c9527b0fa8f4449c0

SHA512
7c1323f8be62e40c6c0fce38de29aa863545557e5abbd5d15cd620c7b7210ae3a7a56e4d828e79ba796e53396922a21b6bcb484a8fe2bfc33ef4561e3b086b08

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
119KB

MD5
87c310a80d8e2f415afce95124b53f13

SHA1
44da1c45b7ee72b36cfdec9f69fb67914a7c3fa2

SHA256
2c19426ac1c2d8132fa8b6845a2632b9b6ea887f397e5ed57c7d500f37066a8c

SHA512
9d355453b865716f0d20ada35067655ca65d47b79471e9ae26fef54bc5d094dc1be04adf22d094d648edc71f244d8aac568e93778ca4903625332117aed099ea

Download Submit