ef3cb958d895f5bfb8ef5ee697a06b3510dc39afb606679ca0490a38114f5130

Analysis

max time kernel
120s
max time network
22s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9344415643eff0e5ffb1e7acbdf5ad90N.exe
Size

100KB
MD5

9344415643eff0e5ffb1e7acbdf5ad90
SHA1

f7b56b5fa8db6c66977ac26c4c32cbd6965f3578
SHA256

ef3cb958d895f5bfb8ef5ee697a06b3510dc39afb606679ca0490a38114f5130
SHA512

6902add7e9400d8d64a3eb26a428ba1d7748af9da87f3bb8d8b52c66124d0227898b5edadf041fbbc468cd01d67a61426c62b327ba9e5b3828fb7ef29c6a3b3d
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXa39:RqKvb0CYJ973e+eKZ0VI

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2884) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre7\bin\sunec.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre7\bin\jsound.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\SubmitWatch.3gpp.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre7\lib\jfxrt.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Araguaina.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tunis.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre7\lib\ext\dnsns.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-actions.jar.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	9344415643eff0e5ffb1e7acbdf5ad90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9344415643eff0e5ffb1e7acbdf5ad90N.exe

C:\Users\Admin\AppData\Local\Temp\9344415643eff0e5ffb1e7acbdf5ad90N.exe
"C:\Users\Admin\AppData\Local\Temp\9344415643eff0e5ffb1e7acbdf5ad90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
100KB

MD5
44d0a257ae213a6c1b9dc53aa00f1a39

SHA1
cb5a5d0e696210737826972c5fee096669c3b37b

SHA256
c57f5f1dab77fe8210b9647c446d37370cd9385deb283e4275a221fb183120ed

SHA512
9a08b25e3ebdc023c24dedd8730537300ec6b70ccfc652ecb3e2a89c75a1ceb60c005538a4793db3a9a77e60b5751125590b98ba136cef147501a495faf74048

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
109KB

MD5
70d3f81b47357dfb883ac94d9c0d3948

SHA1
a1694d56b3071b793d76311505a428fb0bbc0c77

SHA256
f167bf7036ee04a545e59f918bc2d3e8af92646fc02394f912f570c8eb83b8a5

SHA512
cd10b80e4f6abffec94594111a96e4b61cae2b12e72599744daa32d6a1aa99c3e7d02d98a7110e53471e320d21cf56d6799477481930967b372f81f619556cf8

Download Submit