89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
Size

106KB
MD5

2073e1939210e19d7d7c552d55cbde3b
SHA1

c29782d2dd220ca3fc45f86d992c6cbcc684f8b3
SHA256

89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444
SHA512

d77298786dba5e2e6f33738d76bbee7ed5741fa52f9b0d34f5a755d54fb003b0503fc84af250965a9a1358a2b01ee0d0d1844c1fe5aa10f0b5f1702ed78f6b91
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7fm:RqKvb0CYJ973e+eKZOf7fm

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2955) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Mozilla Firefox\nss3.dll.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Chita.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Internet Explorer\pdm.dll.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe

C:\Users\Admin\AppData\Local\Temp\89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe
"C:\Users\Admin\AppData\Local\Temp\89cf630c37d9644c19c1fd95f05bfb9341ee6e537dee6be496488369faa87444.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
107KB

MD5
04442e22d7ecab53bf34673bea8e6c7d

SHA1
95d72db1fe56163ead857edd4b1b16649bc63ccf

SHA256
329498a7fcce348b154078c9def6f2e99fed47e2af07eab844f7fac21f7e7e64

SHA512
3494dfbf6f735dc320b34498678d38165167ec35c855e0ea4cdc490667de835a8b8a1d559c6201ad6ab89a3154b52433b206866825cb9e2190ff19139d2b22a7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
116KB

MD5
671d2e37302511449f5618d8859d1d9e

SHA1
5aef60b56870d4d29cbd4dd0baeb97799074a868

SHA256
0752115ef43fba7eaa2d5027d2be78be44744f142bb88b679e55f6538515a397

SHA512
96ffff9e4fc2bf24ab79abaf7e9901a8d2ea68022880d06474e09e4912241bc3a9aa92cb9d2f5d45a3102bb09ee7ead54a385fa66323ebe71ed731578a8ac114

Download Submit