db03aac8d42b9271d7a4f87c1a05487862d7425c562585f5e0b34c555b1f5c5b

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c37b7ebeca6df6b36b205cc39986ae0N.exe
Size

45KB
MD5

2c37b7ebeca6df6b36b205cc39986ae0
SHA1

b9033fbff0d1ec20d7dea3ea396a9914dc88eac6
SHA256

db03aac8d42b9271d7a4f87c1a05487862d7425c562585f5e0b34c555b1f5c5b
SHA512

cb15d96ce7dfe78b6556ffa88c1c8485b9e75c350474f8898f420ad82ab6cb59ef21d630d600496a06766c891554cd5be08552b09280f987595321133a67c0fe
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpRo+fOiJbfo+fOiJbCk8t8QPKrGrA:W7ZppApBULcfpHLcfp/ZeLPEwA

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3108) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jre7\lib\security\trusted.libraries.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jre7\bin\nio.dll.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\shvlzm.exe.mui.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp	2c37b7ebeca6df6b36b205cc39986ae0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c37b7ebeca6df6b36b205cc39986ae0N.exe

C:\Users\Admin\AppData\Local\Temp\2c37b7ebeca6df6b36b205cc39986ae0N.exe
"C:\Users\Admin\AppData\Local\Temp\2c37b7ebeca6df6b36b205cc39986ae0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
45KB

MD5
d74173d156abf4ab293d227522fa54f1

SHA1
a92bcaa67e8ef8e81a3d109ad1c9e736099238dd

SHA256
33b6fe07df0c8ccad694c78f809c4eb776e67ac68d191c6bcdac4eec97be1ac4

SHA512
4ec1b6e3c71ed0f40f156a7c38543fc777e8c89125c73554baf47a258772a3f061835fc778f89b754aeb58258789b485267d2e9d4b79a4f99c778f1c312288c0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
5ffa73254ffdd2066e5329a36d2441f8

SHA1
e4ac7e67abda7b063d2c2009a5dc7adf68ea61f4

SHA256
6f0a48bf94406138e7be4f9d46670ef59503d55ebe05719940e34a23992d1590

SHA512
08c38ba7d78efe204e6682913d0c6fbd951682f9c57e5c25cde635d19c017157de79076591fdd16d4b819d6abc8981977d333c6de61533ae56f951fde3951b3d

Download Submit