950c8085355d2af7307157e00c28c2ec33709d8ce1e871f08ddc5a321db05f54

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

140d299ed59d5d61227053ee68a48c30N.exe
Size

81KB
MD5

140d299ed59d5d61227053ee68a48c30
SHA1

5ec3c510599e3b39a4f6e67dfe12fa2bf17487ab
SHA256

950c8085355d2af7307157e00c28c2ec33709d8ce1e871f08ddc5a321db05f54
SHA512

9d7672382106a9dfa2d0a43416073b75e71a337b2d8a2e7fa1e68552294723470f0ef723db6997b17f5968ffdfcc7a6cd625d30747262233a0d87664ba33b844
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBK2LUf7XQeEBIEBF:69WpQE0zUzXs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2893) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Mozilla Firefox\qipcap64.dll.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ashgabat.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\GetMeasure.xls.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\DisconnectPush.jpeg.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\New_York.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jre7\lib\logging.properties.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_ja.jar.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp	140d299ed59d5d61227053ee68a48c30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar.tmp	140d299ed59d5d61227053ee68a48c30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	140d299ed59d5d61227053ee68a48c30N.exe

C:\Users\Admin\AppData\Local\Temp\140d299ed59d5d61227053ee68a48c30N.exe
"C:\Users\Admin\AppData\Local\Temp\140d299ed59d5d61227053ee68a48c30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
81KB

MD5
65f25f11c296557ccea664ded17a823b

SHA1
3a70f9230d8d20b338924143781e23959d50fad7

SHA256
e4769bedd1e95a97a8636ddbd1d758c39e82abe1a0fe52471b761542f114c003

SHA512
a626e0b01b2bf06a16d2089bb33f8b9a6442624056ca000dd47d955966653a59a82b95bb8c57a9634958b9f5e6b5500183bdd6b95d81516d1eb0a64d42ac4af2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
90KB

MD5
a93fe6aa5427df2a7829e7871404b71c

SHA1
d038dd1c5aaead6d5ea253efc83a418b971ccc9a

SHA256
091dedaad0200be622cb3f1cc222d949b526b452a41e9e48052e9efcff1aa1b5

SHA512
3f7fd1cd2f13beb98dd57c26f28d6680758670715b08d4f1da47b6ff2c01a9729da1c5f111fc282cde4f9c0d945fe9baf1afc410d82a02c3c0290cc949c2a73e

Download Submit