737b5e38295d338e4a13d6b96f4820a477de8ac1a2261d60a7c7ac04e36574d1

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 05:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5b09f5e443bf42fdee5b424c2022bf10N.exe
Size

37KB
MD5

5b09f5e443bf42fdee5b424c2022bf10
SHA1

05cc8335e7a7cae320290a16b020395d042875eb
SHA256

737b5e38295d338e4a13d6b96f4820a477de8ac1a2261d60a7c7ac04e36574d1
SHA512

6a51ba24709c50640d075d08375eb7f1c17285324ff5813dce04a20d14baa84a8c7fda813d078aafacf301f33c8e34e7f2f15a65a94a3d61e941c83c1f0238d3
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/Fzzwz8wAxAJUOWwAxAJUOT:/7BlpQpARFbhNIsxAJU5xAJU+

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3448) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\PurblePlace.exe.mui.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\MoveDisconnect.ps1.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Windows Journal\fr-FR\Journal.exe.mui.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jre7\bin\decora-sse.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Windows Defender\MsMpCom.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jre7\bin\npt.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jre7\lib\security\trusted.libraries.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\VideoLAN\VLC\skins\skin.dtd.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Windows Journal\it-IT\Journal.exe.mui.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnoseek_plugin.dll.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp	5b09f5e443bf42fdee5b424c2022bf10N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b09f5e443bf42fdee5b424c2022bf10N.exe

C:\Users\Admin\AppData\Local\Temp\5b09f5e443bf42fdee5b424c2022bf10N.exe
"C:\Users\Admin\AppData\Local\Temp\5b09f5e443bf42fdee5b424c2022bf10N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
37KB

MD5
b3cb160339b1a8443835606cffd2e73f

SHA1
2bdfd77fc04b51fdc9f23b74871b83cc8b2fde0a

SHA256
0fb733bf1fe89895bead7dac7c50d6b1383bff1612a204c2dc1119c4cbd34a04

SHA512
33942fe3f3b759d7b6f09b37b79e7bd8a70880bed9ad4e71c4d130c792dd609cb9335383a72770d20948821f2f676e49388fdb3360f687239c14ca12e80730ec

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
46KB

MD5
4175f0b3b09a332dc479f0390fb33c70

SHA1
5883ae53a66b010a9447e18fdad036380cb81a8c

SHA256
44605fecd0b07fc5d253da44104ede344df45bba934fccbce93ff78f7b0301fc

SHA512
b56680da16dd769d3efa2aac997fdc61254dd9b9946ef6d5448d2247b2ba4c03b89b67ebca9b868c606f7b312499d250c7253845792b98b6f44678d745df7355

Download Submit
memory/2660-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2660-664-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download