a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
Size

38KB
MD5

904f02cf7a94c9aa73ea66150ab376b0
SHA1

118e72d9f86c996f4b8eda20cc86659f85ddd4b4
SHA256

a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118
SHA512

8893a47a2ec6230824d9936f2ef563e44528829695a1d4812261ef00b81d4277b838239b332fe0b2b977bcde2afb92803d778c16b66b4dbfa9399f0154da3959
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lt4V0IhAFV2RuH22V0IhAFV2RuH2Q:W7ZhA7pApM21LOA1LOl6AE0IhAFV2RuQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3122) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Mozilla Firefox\installation_telemetry.json.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Hermosillo.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jre7\lib\jfxrt.jar.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Games\Chess\es-ES\Chess.exe.mui.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\Chess.exe.mui.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Microsoft Office\Office14\VISSHE.DLL.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
File created	C:\Program Files\Internet Explorer\ie9props.propdesc.tmp	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe

C:\Users\Admin\AppData\Local\Temp\a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe
"C:\Users\Admin\AppData\Local\Temp\a4f3bd7a2900cfaf2652923d5d72bd101c3116dda2fb9801ada1251b451f2118N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
38KB

MD5
b1a45a60bf06c2a0a5edd41b97e12d3a

SHA1
af2c3798b413650c7c1634d768e946489395faa1

SHA256
b8bb4f7507346774e11c46d6437c628c7644f46768d966f15f32d74d64c0594b

SHA512
3e8405f4f431ef3ebdfc80cefcf573126764768df6bb2229f37a47b27dad50569b44d50c9435f3b5e10f5d0acdd0bb5d70a27f513b4306db5cc65bf4260b0a20

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
47KB

MD5
8cb78b8d2c1abdd003a13e0dca815e2d

SHA1
5bd761d3a1f751dded81f40c2a127724e0d195b2

SHA256
f860646fb72b749ccfd8c2f32e7681186cc8f39ff8fd2580ce00b8a9a0835031

SHA512
af56caf3be486f6bd70abc9dddf06706ca3564974d90a33de177bbc075249480ce5d466d983db6597b1c22c3e72e27d9b2157960104d02c7b7ecda309b21b88d

Download Submit