18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d

Analysis

max time kernel
148s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
Size

88KB
MD5

20c4e634d50229d9d9c799d98ca7c249
SHA1

1d19028c91b2cf1463c3b2651395ef2a8a107b6d
SHA256

18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d
SHA512

e50f100ef2637d42fc947a3ca50b1dc98df6ce087cf32fdac1cf6443255824035949c15402e488649accbf73e4bfc7eb3ecb4bf3087be1ff1e6652244c7d65fa
SSDEEP

768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmhyEXBwzEXBwujh:W7ZDpApYbWjIoPyPoLzV7c6ShT6s

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2820) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Havana.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-execution.xml.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jre7\bin\javaws.exe.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Microsoft Games\More Games\de-DE\MoreGames.dll.mui.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent.ini.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe

C:\Users\Admin\AppData\Local\Temp\18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe
"C:\Users\Admin\AppData\Local\Temp\18e2ea78f9ed4be346dad244c4c3543e2cd20682296287e74cfd6801ea76557d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
89KB

MD5
585239efcc0ba8875bcf0855b121105a

SHA1
62855b4cad510f8b68fca6d991c34b6a03874051

SHA256
9bac13e928b9780e4e65df8886f60b437815db2e96fb8fc88f1df9300a9db312

SHA512
64d6cf3add9a190c40005ee413334dbede21a7ca7e8d221cb60dd1cf6f6b5fc9e948b9dfc685b3f74281c2f3f9c791b5275e406d5f30bb36e334114343fee2b9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
98KB

MD5
fcccadd8c03ca333bab47442a46b6f11

SHA1
f67f176de78e9ce4b8753018dbc89d1eef424c7f

SHA256
c5b9ee2167e7306eef4e81dce9612ec7a790ac878f93ac4cb3bda3fe2394eebf

SHA512
6376835721b6dfd79f29e6ae0a7b423de9f83813e3a3cc6778411819ab157bd5ebfba3b134d925b0f8dbb010d4d851feed9c13beb5fe04cdec163fb51b17b68f

Download Submit