5d11f38c1f79bec81847f6bf43bddb3ce9b524b3faf5985233d77f50912a753b

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03-08-2024 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27f792b5c75995cf7171f735aaf31660N.exe
Size

37KB
MD5

27f792b5c75995cf7171f735aaf31660
SHA1

ebdb1dfed136902710fd0e207c8f54e4e1e17599
SHA256

5d11f38c1f79bec81847f6bf43bddb3ce9b524b3faf5985233d77f50912a753b
SHA512

1fddc31968dc07d33d88490b1936c89e31a6695f1d925fc656ed139071485f7d477c05e1a514b3d796bd9e8a7bc5873159aa40d14f9201d3f08e25aaff5b88e9
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1h:W7ZppApBULcfpHLcfpSo3fP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3214) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\lib\meta-index.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\bin\java_crw_demo.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\bin\management.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\bin\prism-d3d.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\lib\javaws.jar.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Araguaina.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Monterrey.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp	27f792b5c75995cf7171f735aaf31660N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27f792b5c75995cf7171f735aaf31660N.exe

C:\Users\Admin\AppData\Local\Temp\27f792b5c75995cf7171f735aaf31660N.exe
"C:\Users\Admin\AppData\Local\Temp\27f792b5c75995cf7171f735aaf31660N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
37KB

MD5
a7bac0e981af63bbdca4f0384636813a

SHA1
9bc61a09d7a1918c47d1cb16538d52e52b12d698

SHA256
32367e787136920ff71e6aafe09d5abe53e5d822b240f84edfdd4517cf262917

SHA512
b8311fea5412242241f091d6da7d74b177f5820bf08522bdf6edeaf852b516a6abd7147ebc63d29b9dfd1bc8ef04fb8d3cd2a9edb8c2c720cbcea84ad161d8ef

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
46KB

MD5
8544111f3a0b59b8e081253e1d50e001

SHA1
ed669acc91d925470053d0ddaf204a093bc15a79

SHA256
8bd6be7546ff8ae032c1404f6c8fcd050131cc7e6615d016dd8ab07efae77c31

SHA512
c90afd1e867847fed8d95d07084e82f8c53900cd0e9ba18ae075477dde15b200974c4edd25de343e6bacd32d0b3b8e732e9c996bb53b30af2a9977f33b92e082

Download Submit