ab487493a7467eed21c6eae8a9e6dcd55b9fd1582c5f0154f33d48e502e67bc7

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

074c267e9912123a18e8909e1444c800N.exe
Size

101KB
MD5

074c267e9912123a18e8909e1444c800
SHA1

9c692f9ffaeb05a57785bdb8c66ba36a69804c52
SHA256

ab487493a7467eed21c6eae8a9e6dcd55b9fd1582c5f0154f33d48e502e67bc7
SHA512

560f6b599e3d2eaccb03eabd598b466fd0a60cd61a07fd89993a0b7bc31896caa1a7140f0df88e07d11065564c8785eee0230e1f6a361504b8ee8f8669b8452b
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBj:PqFF2Ie+efsim2A5h

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2872) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jre7\lib\zi\CET.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jre7\bin\fontmanager.dll.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.tmp	074c267e9912123a18e8909e1444c800N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp	074c267e9912123a18e8909e1444c800N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	074c267e9912123a18e8909e1444c800N.exe

C:\Users\Admin\AppData\Local\Temp\074c267e9912123a18e8909e1444c800N.exe
"C:\Users\Admin\AppData\Local\Temp\074c267e9912123a18e8909e1444c800N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
101KB

MD5
ea39ea8bb343b3ec1e62170d46c401f3

SHA1
43d1f813105ec993132bf0efed77ff9377bc221d

SHA256
36cc316831a5f34d755588bc790fac12d7fd79147f489b55e0aeec3be8ab5030

SHA512
74471411d011bab7d5f8883486e1ed2774549826280b86763016e3e260ea7ffa1d5729a6336e1225ecb83a1869a7b53528ba2264aa1f2ff5c8f71d459d407675

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
110KB

MD5
a41d142d26a48c1280bf0c504486df57

SHA1
26fb71af96742aee696f83268f1ae09e45ae051b

SHA256
5f4196f0038e0cba509dd175a00dba49a5d63671f45149bcf62bb706f191f311

SHA512
6895d7ea8648839653b46cafcfe2f246e4a8477d9f664610f5b91235e4fa0f2dcc25c40f8e9bad26877de2b47310f37aaf9b9858edea44b5a2b14d3caa1125c1

Download Submit