d9f976eef150134408dfc5fb74d40a785bbfd9a64287d7263d07c440f876ca11

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bb4457991dea06e51aae42ccf7bce30N.exe
Size

37KB
MD5

1bb4457991dea06e51aae42ccf7bce30
SHA1

9d501ab4171858a8d38de394137906382a31399b
SHA256

d9f976eef150134408dfc5fb74d40a785bbfd9a64287d7263d07c440f876ca11
SHA512

92c9f191e067fc73d69eb798d3552e95795078ccccd741fa969efaefcbbbe7e6a7b8f18348ec3eb20164c8079b01d2a0f9d8eeae3fb28c4729e6580ac7d9c9c3
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1e:W7ZppApBULcfpHLcfpSo3fs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3367) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre7\Welcome.html.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre7\bin\JdbcOdbc.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre7\bin\decora-sse.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre7\bin\jdwp.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre7\lib\calendars.properties.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Anchorage.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Regina.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre7\lib\ext\localedata.jar.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\ChkrRes.dll.mui.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\vlc.mo.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bb4457991dea06e51aae42ccf7bce30N.exe

C:\Users\Admin\AppData\Local\Temp\1bb4457991dea06e51aae42ccf7bce30N.exe
"C:\Users\Admin\AppData\Local\Temp\1bb4457991dea06e51aae42ccf7bce30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
37KB

MD5
e11a5207b8365a899d6005b14772f5f4

SHA1
356c0da789c88854480c7ab14348038f0f96754b

SHA256
c83163f729f7ebb16ccc21394a4fe99326fb5e628199e90d8027b535b83c0550

SHA512
f7d38075e14912fe74a51ded842f2ae1a2c7c1fa9fb3012c7e4f0391064d4c5b474cef4b58a0573a881d0fddaad1658f15561fce8c9c6a052db7f3c96f2a81be

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
46KB

MD5
741e2683446f31c162ae8bdc39d9919b

SHA1
76b9500f475bac74ae0b9432e8e9a99169a0fe96

SHA256
1ff01cee0998f6988fbdc18c4e800e07c204031eb7d4451c53818b3d63744dc0

SHA512
ca93cea0fcb033d3d2ce06231a71d7448143df36466e1761ff7bbd8941b873bdc65baa59885cff95dea841876eb3f3903138fdad9d9874414f009c20366d2218

Download Submit