6b946a84f446141c28d404667a9930bca0a235fbe00f7cf296bd13f598fdf533

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

077cf1830ce7c5815bc4c17dcea3aea0N.exe
Size

32KB
MD5

077cf1830ce7c5815bc4c17dcea3aea0
SHA1

b89f98873f09acc1de997b5207e5e36a979cb245
SHA256

6b946a84f446141c28d404667a9930bca0a235fbe00f7cf296bd13f598fdf533
SHA512

f4e6bd9b04b71cc51bda0eb334a6aff987a1c2116d32717d73e5bb498af227cd025793eef66cafece2c51aea6eff69ebe92afde160ec989297c248014b7ab493
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxjH:yBs7Br5xjL8AgA71Fbhv/FH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (790) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Almaty.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	077cf1830ce7c5815bc4c17dcea3aea0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	077cf1830ce7c5815bc4c17dcea3aea0N.exe

C:\Users\Admin\AppData\Local\Temp\077cf1830ce7c5815bc4c17dcea3aea0N.exe
"C:\Users\Admin\AppData\Local\Temp\077cf1830ce7c5815bc4c17dcea3aea0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
33KB

MD5
46c736022a622f6ae5f8bbadf5ba3648

SHA1
e3fcfe5c2d5c71f76ed9e8adb32b8de259d9f03e

SHA256
8df5b0ebc6107d85a286279f8275adb9fd69cdecd2a0f91b1663d15764482b12

SHA512
fbcc9971e5c15ee03d35e38b8a66bf3881300eeecb2ff23c2c691e8b52328e4126b97ca0e7f2ba81eb2d51fd623207d1ee01f382f236bd89e4c33c33383991ec

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
41KB

MD5
0ba3968ac7cd89a69a98c81b02f62e31

SHA1
0c455c227e68a7a73f5df8bc96e7e5afc424cc5a

SHA256
1e4aacd6878f5cff5fa1549529d4fd9be11742f0e1ef33a0b160040f3f4789ce

SHA512
858fabc0d035982bf05eb10bcb56d2fb36e27a6d1c1bf16710c0a86c421b4f1c45520d33dbb22d3c6d1f2a4405c7bc76db979a452a755f68fdb004b5fec28ca8

Download Submit
memory/2984-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2984-102-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download