315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
Size

94KB
MD5

60434b6922f9c9729af1e0f188be2060
SHA1

48cda778d91eab16384cd26b43c5cc3e134447e7
SHA256

315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04
SHA512

4fb1b3d441b3581ab8bb4ba7ef2302a63d4b037b92908de7371ad90b1fa8b8c5ab463cffc5946a0b74da8c4f4a0bccda1041862fd04402732eb9745eeec4e25c
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYjh4J/e8J/eYTC:6e7WpMaxeb0CYJ97lEYNR73e+eGGW

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2871) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jre7\bin\eula.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jre7\lib\deploy.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jre7\bin\npt.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe

C:\Users\Admin\AppData\Local\Temp\315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
"C:\Users\Admin\AppData\Local\Temp\315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
95KB

MD5
de4bea9327d7155ad108d592b8c0b736

SHA1
843d0656bce3c5388b0c9be03cf6b95c914cce05

SHA256
4d3a662c4c1f899331e1df48bc6895f7ba52d3e7ce9c62f2071f855fa390368d

SHA512
a0bdb76fc30ce9cc00ead5cc8fc9c927277389a57bea69cdeff4976483d4ea567982a530b50a0233b45ecd20393b17f337ff7347ff061e0d36eec8f1e1b1a8ce

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
103KB

MD5
b348ef722a55ef83d4c9e51925f1baec

SHA1
4ac62e8534db414207b48e85c545645dcd7aa642

SHA256
bf379f8d6db8898843733c3e77f6ead3f7c2cd99962799b0e688bf61d9fabb9f

SHA512
266c5bbc2a55a855e088489e5a931c92c88f633216d53a84e4c81952760036aafb66b9890eeb9e51606b179b83cd8dc7005b7f2f5eb39cc14ada3e5f93272062

Download Submit