75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
Size

36KB
MD5

a0e76d34b43b392e2a8065b05b4ff7f1
SHA1

2c4ba3f1d3ec711eb2bf8180751a426d146c1f17
SHA256

75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628
SHA512

051377b8023df8c80d9f9b1b7f7bab22c96beebcd99d07add078b68fb2430e8a6fd2265759c77400c0a18d8722e0f3b999d18b9f385aecfc1584b2a5e09e6214
SSDEEP

768:W7BlpppARFbhjbhQYjYY4F2j3TK54F2j3TK6:W7ZppApB1W5W6

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1000) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\OmdBase.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Internet Explorer\perfcore.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe

C:\Users\Admin\AppData\Local\Temp\75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe
"C:\Users\Admin\AppData\Local\Temp\75c3272c0249c5ffddbee6ad219ccd291675d33fcf78300fd806d763f25e9628.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
37KB

MD5
22363a571e10d5c1cfbf87dca8799333

SHA1
2cc82b4e305a84cd61d17f12c5583a15b6f3548c

SHA256
a2f42938398d2696c4d4b2300e837b2a1bc67d39fc4295f237f975a987aedfea

SHA512
291bde40bb534581236fa4658c89cf97c29de4ae43e5453633d17658431832682129543439f17b96fbb80169513226c7421180764978febd01cb5a8d8e2705b3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
45KB

MD5
e2827b5e0fa5111da4b1302811c87e81

SHA1
0cb1afb060564a25092a7d31b014a57d0af173be

SHA256
09afa408bc0fb3a2150f3b9828cb012f7e9814e2ae3c2e542aee4ebb3552d664

SHA512
0e63245580522d1610a16cfc5ddaa3e92128ab64dc9de592393ff910db511fe0bb9708f32b3a52a2e32d47dae2d377279e54253d591103626183864f89aa8960

Download Submit