7d68d4e282d3be52889192e45d5b6a36dba4e487e2ff86cfcb708a31207c5374

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85c2b69a9fded1f71f42c66aa53008e0N.exe
Size

98KB
MD5

85c2b69a9fded1f71f42c66aa53008e0
SHA1

c094088471066a5d9b3f6db4463f779115fbc4e7
SHA256

7d68d4e282d3be52889192e45d5b6a36dba4e487e2ff86cfcb708a31207c5374
SHA512

502d9ec0496d89edd4bfba5e01f94c4c84b31650468892d0ab8f4a1683a4f65a848b0cd8ad0e23ac235a8d286922e905a693387b11bffa553f911a9f2d8f4df1
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7fv:RqKvb0CYJ973e+eKZOf7fv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3098) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Marquesas.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wake.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Engine.resources.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Mozilla Firefox\updater.ini.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Resources.dll.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	85c2b69a9fded1f71f42c66aa53008e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85c2b69a9fded1f71f42c66aa53008e0N.exe

C:\Users\Admin\AppData\Local\Temp\85c2b69a9fded1f71f42c66aa53008e0N.exe
"C:\Users\Admin\AppData\Local\Temp\85c2b69a9fded1f71f42c66aa53008e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
99KB

MD5
9ee601daabfdb2e6591d9f498e582019

SHA1
a346d968ede96bb3ffe54fa99e03cf9f66e18101

SHA256
0c28ab9d1a7e08c016a32c30c4a7275b8eab358ab9220c896d51ce62e7c863bc

SHA512
16921376fbb7e956971fa1bf0a9b144a1930ab35211dd0e17b52cca0fc2c1d2a196256ad6a774a44ef7f5e6e5b7414daa1b6afd5908f0243d96d9d67897d1580

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
107KB

MD5
b5537686e1ed8b9e78cdbb1630ec6b51

SHA1
fb6482ba389207d83a41aee08373ebbb080202c6

SHA256
2d73cd2a3b62fb019b79afd3e3939f0290f1fe765ad31586bfb6bffdaab3d716

SHA512
ab7bf836341c72cd181a1de02d1f26b2fd7bd63311efcc47e81bce43be4ea07e382c7744ccccc2f34504b16dcc16376e724a282d62b255ae41c9a45d87a766d1

Download Submit