22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
Size

48KB
MD5

f79edba4b58c43ae6991cb41c8e80f71
SHA1

4a37855a8fb7c266dae3559edf8405fd380ca0df
SHA256

22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af
SHA512

0afa7c500e9f1d37b32693115f1552f7d9a7b200496196e2c248a191190a956175be900d635b2e78579ea40027967ba4ca07dcb79754908447de325220d841a3
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJwRJofJoToYkGiG+:W7ZppApaJofJo8Yk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3880) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_over.png.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\reflow.api.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_up.png.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_top_left.png.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jre7\lib\ext\meta-index.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\calendar.css.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Mozilla Firefox\locale.ini.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.png.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\weather.js.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll.tmp	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe

C:\Users\Admin\AppData\Local\Temp\22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe
"C:\Users\Admin\AppData\Local\Temp\22c5298efa613da5b27d57ff527a2f32c8c36632c18478ca1e032aa6366a68af.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
49KB

MD5
605aeb0f76c094da845054d096a56999

SHA1
844e4607e062dd0f8c9b0f3e85cc1d6ca9564547

SHA256
6228265c1fdb8b91add21dfa2d01b318751d3b8659cf951f87acb3edd0d1e560

SHA512
35e4d45ec8d2413d05fb76a524ae1167f9d021d2986f2ca79fce71e4d4077ebc162e983cb08cb96cb0f9fe88f424d175cc37e47662f9d0223a251be3c89aaf18

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
da4e239559f349ce016809c69aabdf8f

SHA1
a31c3870ff5addb7bc5361513be0127e008fa01e

SHA256
0a79074a02daa4440825b48fd85c536fce0ef8eaf52a28a3d6871b904ccfd1dc

SHA512
23753bd48988b8b54c7c3883635ee590545ce4ac2125fc1275d8a9ad1ff5272d8aa451c6b5ef71841ecc34ac8cf5ef0fb8adf42240f7d6365b92b76a32d964d5

Download Submit