af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
Size

47KB
MD5

a31994b5996371574186b3aac2aa2d69
SHA1

c77169cbe508d048b5eafca12dce304a0ad28d38
SHA256

af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3
SHA512

4cde9bdec60cb37b71e547ac431f5258610b2d610543a65a1fd3335a466234ac410ac86cbe78daa84ff0017d7727fda803f9df4847468ebd05f682b9ea838ee6
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFcdyGdy+zWzS//1g0:W7ZppApBULcfpHLcfpyDcdyGdyav

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3457) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.sig.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgRes.dll.mui.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Windows Defender\en-US\MpAsDesc.dll.mui.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\DVD Maker\offset.ax.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jre7\bin\jfxmedia.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Mozilla Firefox\libGLESv2.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Windows Journal\fr-FR\jnwmon.dll.mui.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d11_plugin.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Mozilla Firefox\updater.ini.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\CloseCopy.pot.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jre7\bin\unpack200.exe.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jre7\lib\management\snmp.acl.template.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Mozilla Firefox\locale.ini.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe

C:\Users\Admin\AppData\Local\Temp\af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe
"C:\Users\Admin\AppData\Local\Temp\af638533e902d7aee290d4f2905b811b4f63e77015cbdfdf714652bfb0a669a3.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
47KB

MD5
590e1497c7c37dd4d5fe1f675577287e

SHA1
fb61d17005335d1bd88657dfc1cc4f4318890914

SHA256
4b182525aa5556e10130232895262e55f8a5e4e81a3b756e0c84f65fffab42d1

SHA512
0af513bbe6937015869ce7593214a5c3678e8c894a9403a8e3112683384cddd60fb81004851d78c21d9ef98bd8dfe78abb784f5c3cb657bb7da1406314dfab74

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
107b43467b6f880842c3550d9dc64dc8

SHA1
2cb536a28f465247fd24b94ab3a8fabd1a254039

SHA256
2708a2993c521fb10a48007b85889eaca1d3a5cea70e24306406330d8fc1e10f

SHA512
023920c5d75e194f1964afad02068937301eb6a01419bb65266de0066006a5fa5976d00a7a1fb7a99429ac3de65a19164f4f94167fea69cb9befe68a7f567636

Download Submit