8689444c973c5ef81c372fce472228c51eb7cb247209ea6d7f304dde1e486a48

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

516397e4d516e0ec1d6943ddd8656150N.exe
Size

84KB
MD5

516397e4d516e0ec1d6943ddd8656150
SHA1

87dd469a1122a1eb358b647eb9fe30dee7a87fca
SHA256

8689444c973c5ef81c372fce472228c51eb7cb247209ea6d7f304dde1e486a48
SHA512

73335b7f88dbe846bcf3d07148f561c18f2c852e15ef71d25ac4c8359f75b980c2e3ef172289f0779d11d89cc58acc4e8dc97c6c95b32ef4ac5469bda829e334
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWFYcUYcN:6e7WpMaxeb0CYJ97lEYNR73e+eBSWs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3166) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.png.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Mozilla Firefox\osclientcerts.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Mozilla Firefox\Accessible.tlb.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jre7\bin\jpeg.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\VideoLAN\VLC\libvlc.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	516397e4d516e0ec1d6943ddd8656150N.exe

C:\Users\Admin\AppData\Local\Temp\516397e4d516e0ec1d6943ddd8656150N.exe
"C:\Users\Admin\AppData\Local\Temp\516397e4d516e0ec1d6943ddd8656150N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
85KB

MD5
71db48b9bae1981c1eeed2241502d63c

SHA1
3221cea84102679e11b9d6ba0e648b6e782cf545

SHA256
c0912e1d42b6c61c60e68141aba489a806bb9ed3d05af94c62280d81961b4ad6

SHA512
5cc9249cd44c56abc28e2eccdc53ce1851513e8b7e1ede05fb88e4206c7787ae7888f919d491c8b925892099059d00ea2465a68633bea8898e0d71d95a473dc9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
93KB

MD5
1e86214b86b78d68ee2494bc42a7a32d

SHA1
17c499765f4ee71bec754d4af97ad92ce0f35e48

SHA256
69bb4d0329b51b30d3aff6e400653930e94a8f42e6d0aafe07392633fc33bfe3

SHA512
c6d8e82b40a0cbb08e7e401cb6d2cb1a50cf768248147b107d047ac3161be135dee36f5ac7c2f978a08d2c7bbf8b7fae54ddc4683b0e1b32a37c6ff969d84039

Download Submit