3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
Size

42KB
MD5

81243aad173dfa59edf52ecf083fa7a4
SHA1

de90a93f513a11e38dbdc9bbc3f826e8e586052e
SHA256

3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba
SHA512

d5115ef1534e51e7406b2a5d71d5aeb45d1b870526b7db358bfb10c82e1e75a5fa27aa8855ac4577281cad12bf72b76bc78daa437142159242433fe27b594552
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsS5fZftKZONZOmZ:W7ZhA7pApM21LOA1LOl6vS3Z

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3735) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jre7\release.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\mip.exe.mui.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\settings.css.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)notConnectedStateIcon.png.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\slideShow.js.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_right.png.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\TipBand.dll.mui.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_top.png.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libalphamask_plugin.dll.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\13.png.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_hail.png.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_thunderstorm.png.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe

C:\Users\Admin\AppData\Local\Temp\3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe
"C:\Users\Admin\AppData\Local\Temp\3506e1ff9a8e47293b22fac73eefec9a4ae780b8a796088d59fff6d967c699ba.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
42KB

MD5
0411ccf1a4636c6c35685d69779243f6

SHA1
7f47cfc192a429577edd27c36b39232e611ac4ee

SHA256
02eaf7f2e71eaea112d4fca231473b7aee6b2d61b1070465904cbe47de856c02

SHA512
36bcea88d19b2a32aad7e5e1d3fe00aa01f993a0c109c603cc5a29b8ab7d32f0d1958b41b9f04562593d99c836ba0ef77712c3763d761a8c6fe980338417c8b9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
331af1427d7cb32406a3d623e4343ab3

SHA1
4fa456d9b4d1d1146a9dcb07c3817fc02f4ba936

SHA256
416366a0c918a7fe549cbed8a15be4e85d6a9ac6e1639410071927e06d3d4e58

SHA512
d8bb6323d989a85565a70ba5256c8acb260a83dbaf442972a93383f2418e41e5ed5840a2add6c7b26381884c6aef75ff258fcf26e180ed186b521da074a63a7d

Download Submit