69e8a6386eb3c1403bbefb14683935309026b0d48e1f8b92a9cb7870ab99fda7

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17c33a5abf675f123aecd9eb0685d2e0N.exe
Size

85KB
MD5

17c33a5abf675f123aecd9eb0685d2e0
SHA1

8a0f827743ff22d631fa51054528ec734234dc46
SHA256

69e8a6386eb3c1403bbefb14683935309026b0d48e1f8b92a9cb7870ab99fda7
SHA512

2b90c7729878e9edd8780341929d616f669df4694893ae9b34124bca6084a73df8d5f5edadd963b068b1094bc21dc59370072f018359d17402e2311f146ed42a
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhS:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3180) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\lib\jfr.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Paris.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-options.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wake.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClient.resources.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Prague.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\DVD Maker\sonicsptransform.ax.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Regina.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17c33a5abf675f123aecd9eb0685d2e0N.exe

C:\Users\Admin\AppData\Local\Temp\17c33a5abf675f123aecd9eb0685d2e0N.exe
"C:\Users\Admin\AppData\Local\Temp\17c33a5abf675f123aecd9eb0685d2e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
85KB

MD5
0bf903435ec84547f5298a30907b6ff9

SHA1
1634981dfae85a3e179aa3d3406df59f4c9bbcf7

SHA256
48a2bd05acd43c12aa5c9ccf0d004a7b85c957dab70e03ed1be5be37bb92392c

SHA512
d4f6116fa0446f6bc8886709de6344d2855bfc100fc0039d8297d50362312c5f8e76d96fefd7f2f9ea063b70d637f5553f04b6c8c9da2305a8e424615f08a3dc

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
94KB

MD5
5bbed178685409c001000df54b0906e7

SHA1
35871445d9ea6857b395ac4c2de7067db751d801

SHA256
ef899d877a5652fe585b8a0b5bc6928e20385c6332ecc399b90ad9fae439a28e

SHA512
592c653d8356cf5b710827f52593aaba2d31afe1dd60527a7789c81f39ceae0cd0140ae56d03a149d2c0e68f17bf1e7645ec971839f348e38a6e20fe39ee8489

Download Submit