ce253865380d90672e76365cd862db53e92575c4547acfdf481ccca6c33c3596

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1323e80262a03719fdc53be25ccfd670N.exe
Size

35KB
MD5

1323e80262a03719fdc53be25ccfd670
SHA1

37cf4795a1a709d2755054f1d09a177e1df9bc84
SHA256

ce253865380d90672e76365cd862db53e92575c4547acfdf481ccca6c33c3596
SHA512

de0986243775c4306b9532506fdb6d7fec7c0aa594a54b31270de331c72d5643ac2aab705d1adbc5278f5bcc3751b8aecc9d7c559ec9249856d2eb5a638ba146
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/Fg3R2JZu62JZu3:/7BlpQpARFbhO30JZuJZG

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2621) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Taipei.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\bin\jfxmedia.dll.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Edmonton.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Microsoft Games\Chess\fr-FR\Chess.exe.mui.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.bfc.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Halifax.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	1323e80262a03719fdc53be25ccfd670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	1323e80262a03719fdc53be25ccfd670N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1323e80262a03719fdc53be25ccfd670N.exe

C:\Users\Admin\AppData\Local\Temp\1323e80262a03719fdc53be25ccfd670N.exe
"C:\Users\Admin\AppData\Local\Temp\1323e80262a03719fdc53be25ccfd670N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
35KB

MD5
7749d0c19f7ef5650dcbd96f6a1f6386

SHA1
04142a76fb595d9001d6e8604db993f80480dbe8

SHA256
1b2a87da725cb447ff1eed6e803964bfabff149691785fdbc582c91e8a368ebc

SHA512
2e699e1f92ecc355fc94725d8d5734380eddf4cfe0e1f5f29b31a033a443c6393f6a9d571a3be55258d02d59e58cc0ad6e764583a1986cc3eb1a34d3a8f02981

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
44KB

MD5
e888a93f97e05a6d9a167e25bc1eab13

SHA1
1008a14eb8d3128d73704d8404a7a9cf95f46090

SHA256
6011131f01c8e173a9bff4d638a9784a7c64a70d2d0a543a037d297d4f37fc41

SHA512
d8c30bb71a5545b2fe0d11fe35328a6cf9ec2ef330a4c3f930821cdcf44f94ca50fa1596b2cc7dcf4e84bff8522e68b06e411cfc13df45b3a11367f77d2b2538

Download Submit
memory/2688-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2688-160-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download