08d01c2b82fa401e0daae76dc6a3188d30e4a4a3df0ef09935d1d9962cb555dc

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88144794e8ff144af8172c6dc702d2d0N.exe
Size

72KB
MD5

88144794e8ff144af8172c6dc702d2d0
SHA1

04b30acdc3b3cad55924f1e28805f0ad14d2ce3f
SHA256

08d01c2b82fa401e0daae76dc6a3188d30e4a4a3df0ef09935d1d9962cb555dc
SHA512

72144e3f0775e951e5984cdb8ce6477f056d841d01eee7516a4fc5c887d6bc153f47230ed08c1088139ab09e50977566c2cf53a250ba24d7a25a2d1d4fa0b3cf
SSDEEP

768:W7BlpDpARFbhYQkQzaxkd+axkdo176/hvYaJadn2vGj3vZd5u5Vcyc+:W7ZDpApYbVK4v4n2vGj3v/sT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2604) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jre7\bin\decora-sse.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	88144794e8ff144af8172c6dc702d2d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88144794e8ff144af8172c6dc702d2d0N.exe

C:\Users\Admin\AppData\Local\Temp\88144794e8ff144af8172c6dc702d2d0N.exe
"C:\Users\Admin\AppData\Local\Temp\88144794e8ff144af8172c6dc702d2d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
72KB

MD5
d112555d589c15c36610ae7bebdf8f58

SHA1
75afebe4f3259f086798f92a4079818d981f0c44

SHA256
417d3de907a4d3ec5be8d19807c2a20654d6fe370221383baa4e8436c22f7291

SHA512
c50013237baf9f1c6fb138fb74a089d1ef7c2ae39c965c2e4eb6a244c649765f09402ea145cf6912d2ca9843bed661314a8d0b2bfd145abe5c5d9418a3136e00

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
81KB

MD5
09a9231876c84061c2e09e8c5e81a273

SHA1
5a84556f251ef78d4b53413be7b14cc8731c0eb6

SHA256
b8c9897f2f08e32b186b3b680bfdad09cdbe2e5e22f01dea310e5c5df4b63007

SHA512
83e7bcfdd1731d1f68524b6ed056f484a0b800fa1cf4fd47cc15b1f420049a7ecc9c6bcedd077bd87f47284129e114e6fd124e4dcbf28a58b17680d26b5a63a2

Download Submit