73e5a913a0d5a147d126c2beace76ddad374a8e3f3b3c03a784c3a5f8672a71a

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25d48c017f3b01d3fa147e3373b88d30N.exe
Size

51KB
MD5

25d48c017f3b01d3fa147e3373b88d30
SHA1

23a9f9d75fee82616f88e5fe9487f1148a43aad7
SHA256

73e5a913a0d5a147d126c2beace76ddad374a8e3f3b3c03a784c3a5f8672a71a
SHA512

478887a429ec80801daef4b816fd2b96078455fc06f901221b43f982c3ea6d119b8e0499963fc1e2759eddc89ac1817996f445d88a3420ed3914416874fa2cb4
SSDEEP

768:/7BlpQpARFbhfUnUnlW1VkRawAlW1Vo+L:/7ZQpApfWlLkLh

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2076) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jre7\bin\ktab.exe.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Melbourne.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-execution.jar.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\EnableConvert.ps1xml.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-progress.jar.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25d48c017f3b01d3fa147e3373b88d30N.exe

C:\Users\Admin\AppData\Local\Temp\25d48c017f3b01d3fa147e3373b88d30N.exe
"C:\Users\Admin\AppData\Local\Temp\25d48c017f3b01d3fa147e3373b88d30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
51KB

MD5
93c2e67217bb98e43f6e4812efb72d2b

SHA1
27dff91410d92afc1d9a09de72b69f4870d050b6

SHA256
96bc8ddb0a8f4484d88b41e3d58e4170ada5f0d16b665cab36def2227756f7d9

SHA512
8ac0e99cb1c67c2f3f71e4151111d41400d4eef44052eb115b6395c6a101636fab0031e63e600f10edd5c097eb3227328f4c0eb887e04666c91c61985aa20594

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
60KB

MD5
9d669cef7fbba5cd0b1724a5f9418f46

SHA1
a9f19864dae34c0fe48a2195298da325f5f8331d

SHA256
9943371ff084bad027a4df7a3a4cfe67e9bba5eaeff399a9d2e40c8c0b66620f

SHA512
16a22436ee6a826965cbf2e3a7120a1d9c877182ae61219b38ebeb7d139f53f8d25af1e6dd809bd7b4101b3564a97b2a3385ec8c13cf65ff3419f25ee201d62e

Download Submit
memory/3044-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3044-124-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download