134aeeea038b401cdecec14a9d80326ea886d3a624eb79348cefd04e21bf4516

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25c856a1b3b301e66d11b98225fbda20N.exe
Size

104KB
MD5

25c856a1b3b301e66d11b98225fbda20
SHA1

c9e7eab14c3d56a54b1b85b970b90a979b156ab0
SHA256

134aeeea038b401cdecec14a9d80326ea886d3a624eb79348cefd04e21bf4516
SHA512

fd4a75d95590510f6fe7b9e9440e33bcb7ee197d9d76d9d512722d4b1a6f67bef84398edf7aefe3ba9f0e7e0da1473bb1522dd5cfdccead66176aca32dbe7691
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBM:PqFF2Ie+efsim2n

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2934) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\bin\klist.exe.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\AddRestart.mpa.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Games\Chess\fr-FR\Chess.exe.mui.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jre7\bin\net.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp	25c856a1b3b301e66d11b98225fbda20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25c856a1b3b301e66d11b98225fbda20N.exe

C:\Users\Admin\AppData\Local\Temp\25c856a1b3b301e66d11b98225fbda20N.exe
"C:\Users\Admin\AppData\Local\Temp\25c856a1b3b301e66d11b98225fbda20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
104KB

MD5
e7c2d98c3e41a65c009c0ac6b3d1f2bb

SHA1
c661ebfd986edcfeb592d210930c42d9fd9dc8a9

SHA256
02425a038b349fd581d1ed13f18f85dc57f42cdcb442ffd6cac88f3c407fc932

SHA512
0b4fef14de256a5f0d39524a9c367f8327e2c62fa34c136cea194e03328a991aeb247aabf1c3162373a7928504a6fff402799af86d78f776dee25b57d6447af5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
113KB

MD5
bdd4441aaea68ff652ae48b1ebab5d54

SHA1
d7c11a84e82670dd1335925e888f2d000f52dd20

SHA256
abb377553ab93de4ecb6d7c33e5f0db055b091cce311bd60839e19379b29ca96

SHA512
549156ce3a02b710152236739159227b273a71a1392aac2e43d77b74aa536d5a3733ecc5f499e1f1d7b697fa4f6782b5514580511f4ff0fe21db0614ac3779d1

Download Submit