f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca

Analysis

max time kernel
150s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
Size

178KB
MD5

00be57af1bdf2a6670b7205cd9bf04be
SHA1

bd9ed66823eca9ea4b527dd0b3e99d815ec0e96a
SHA256

f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca
SHA512

997c0b41cc5a7f87b79829bfcf3a491d182d085fb01109191b855c8f6ed3629b84450331e5cf379df7310369f3792f3450a58b486e9fbd7f16ffc80c4493a793
SSDEEP

3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBgn/:RqKB+tOkWKR0iJ0Mn/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3404) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Microsoft Games\Solitaire\ja-JP\Solitaire.exe.mui.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Internet Explorer\pdm.dll.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libball_plugin.dll.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libsubsdelay_plugin.dll.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml.tmp	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe

C:\Users\Admin\AppData\Local\Temp\f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe
"C:\Users\Admin\AppData\Local\Temp\f96fe6c3040d1cea79b8c2dbbb24c7a09d29951fbcc21b35610dda6832993bca.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
179KB

MD5
e82bea0cb4d96e9280a421abafaa2590

SHA1
443de2905c3cd995ebf9bd858ab3dbf14981a3a1

SHA256
1f0bf17166c21ec491320545243d098ecceeb9f3950c95761f767e90a2e4c290

SHA512
ef05cdf1c2b3bbd3543b2b2596b91dc8fd69699c4400e78bd86a1c96b404724acaf4faf038e1edf7960ec620422ce7d2e49d3e4849449c0a9857c20ea0347c65

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
188KB

MD5
be67571cbc589097bdb2633c4f9a148d

SHA1
663fdb6baa2e7f4129ffe825e25d241228a2f9ab

SHA256
4fee91626a6396d401e2cbdd27e49c9a911aaf4b47b83a28061c5f6637ccabc8

SHA512
77a7072a185d406340a69044299e57d4b4e9d2ffd3ec9781f04e74ab23ae4c2e23af953bafe57d7a565bee0b9ccde5ecd64c12f339e7f106dfd3575c19f4cb0b

Download Submit