ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfe

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
Size

96KB
MD5

9204047e2d41c2c21cf209b5b8106900
SHA1

c990f3b2c1acdbf5f090f98ebf94b3003d14524e
SHA256

ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfe
SHA512

a50d3bbb7c444255ff7cd5a2ddbb517077e3d9e99bae5e9f9d596e5f30730ad82dbdefe186ee1dc2f8e6765ae1208a855f898e700a697f8efe17b8ffff4be435
SSDEEP

1536:W7ZDpApYbWjIoPyPoLzV7c6ShWfxRfxSUQtvta:6DWpLf7f+tvta

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3144) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe

C:\Users\Admin\AppData\Local\Temp\ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe
"C:\Users\Admin\AppData\Local\Temp\ff312a3745c220def84a455959ce9f5a3b86b4c9fce6dbc50d0490d54ca77dfeN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
97KB

MD5
35a2f662fd8656ef613ee3ab084e47dd

SHA1
26b092ed875bc56d50672b94231cb7f61c3b3bbd

SHA256
ab70ee8b1284a5ad0afcd664dbbb06c0d2f3323dda3d1efffc9479c644615128

SHA512
2cca04974c1edfea67d03cb43bda5ae0121f52bc63578456f53a0cf431267df5f5d3914efa8b48f40594fbd6fa72a05325853cdb6c89a1ecb40a6f48d0520e89

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
106KB

MD5
3507e86bfe7e0a9a90979bc398bccbd2

SHA1
5cdc652a45b1ca6efa38ce90b8c7234d7e47b085

SHA256
0cf75966303f678282b08fa5b59a49ef21df4257ff907b6605fee6468c4e82da

SHA512
ede431bca879e5bf0c5b3a47e6874a6e845b1a36a00834ea7ece100b8e1f38dd48a3dcca7b3496ab255a19713b14281e0913068889369da1cc0e7399cc366e48

Download Submit