1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
Size

99KB
MD5

0f49d23cbe24f653294e5cd08c4c8a49
SHA1

1be53840e050e8384f03fcd3961718e8674497bd
SHA256

1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4
SHA512

d47b17168aa24a327c3649b3ca6148a4b513f338812e583b40d408853dfdb6e2274ab1650c8416535cb90390525ad5d6deab1b79b68bedc6885a6eb52959bf5a
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7ff:RqKvb0CYJ973e+eKZOf7ff

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2994) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Mozilla Firefox\application.ini.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-favorites.xml_hidden.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jre7\lib\security\javafx.policy.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\DVD Maker\fieldswitch.ax.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\Office14\Custom.propdesc.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe

C:\Users\Admin\AppData\Local\Temp\1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
"C:\Users\Admin\AppData\Local\Temp\1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
99KB

MD5
d13e79f9ab13288459139d7274eee572

SHA1
55f21ed482b872cfbd819379686c44f558d1091d

SHA256
d66c32caf53d4e834c8e49f890880312f94980c16585092f0ea5ff7b803142f5

SHA512
aa3dcd4720a6e738ef556c57f18f51a60bda489630874fe52f6102af7d8cddb0401d039819419ac22336630c41b148eaa826cfe6499aa334cb6da096c2cfb65c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
108KB

MD5
5f4f91e0605057fd8d251e9a3ff254fd

SHA1
bf6764cf05366b444bc2faaadb3246765106d06d

SHA256
6efe4ad03ec9e81d5bab4dc31bff70a3c60728237e9e51a1a1e15ebc5f14c07d

SHA512
c30d5e12b17fa0320913e74564a4d68a6cd84c504aae6a4a3a47f7883d51cc7c9c28579c0b8e45f54325428c6f2a37c149c15aec7a800a4a887727e065346ce0

Download Submit