51dda95f62ee5a05883a8e4b4be3f7bf036c0221aec5ae7eb3df1dac7e12f0c1

Analysis

max time kernel
120s
max time network
117s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

178a174aa178d3e2b61b7e77d19a0870N.exe
Size

45KB
MD5

178a174aa178d3e2b61b7e77d19a0870
SHA1

f4d436fd629c7eb793285db4f0b51fe4be256577
SHA256

51dda95f62ee5a05883a8e4b4be3f7bf036c0221aec5ae7eb3df1dac7e12f0c1
SHA512

cc374901aff660d0d6570c38ea92eafab8a46e5f1dd13d0e477118aa4979f7140d77d90093b074ed37100631dbe4d8d7dd9bd6130d41a98ee20fc56b96ed7ee0
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJwRJofJoinI5nIWfQfs:W7ZppApaJofJoiwP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\SendConvertTo.WTV.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Windows Journal\MSPVWCTL.DLL.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_sse2_plugin.dll.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jre7\bin\servertool.exe.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\HideSearch.dxf.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jre7\bin\jfr.dll.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Microsoft Office\Office14\VISSHE.DLL.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp	178a174aa178d3e2b61b7e77d19a0870N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	178a174aa178d3e2b61b7e77d19a0870N.exe

C:\Users\Admin\AppData\Local\Temp\178a174aa178d3e2b61b7e77d19a0870N.exe
"C:\Users\Admin\AppData\Local\Temp\178a174aa178d3e2b61b7e77d19a0870N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
45KB

MD5
425d2080aaa7aee7ca2002db833cb27b

SHA1
59ac7f11fcc4fd945d4b6b340f9948febf2b66c3

SHA256
e8ad81c8ff0cf6956d35a69aa38330f2e8d9cb54652c2c09a13ae36a9ec83ac9

SHA512
17a1d0ee639fbd42d1abf603bef354732ee49111440e7f0d4e7da2e0dc4daf7b6fdf3b01373924d2c28c2e5d6246e6ef5dcd9ebb72a5fe77fcc46991a167e870

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
e853d14065f055adf1bcb1cf6517061e

SHA1
b6246e864d4914ccd267e59de2b4aacb9f80d593

SHA256
095682eb074ecb93e891316ddb326e3e4e1b89cf2d3b579869324b1365d60625

SHA512
95766e23c33e74be63044b36707c4cb901d26fb6a15c298b353ee7cc8708847c05109566afeedcbda948ba6f2c514533a9c01775a06653b520bf18f6481212c2

Download Submit