6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
Size

38KB
MD5

4147270974e96a0399b4f21964be7540
SHA1

5e59a40b88b3b777c5705c73f0509994fa431e7a
SHA256

6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242
SHA512

6551e34bcde2cea22e433e12e51669bf7f7eab2c7224f0637f7a9699b9df8887130fdc4c36b57d10b23a9204c50941ced5489f10c372087dede2b9bb017cfe9f
SSDEEP

384:GBt7Br5xjLvassAgA71FbhvYD/DggNNHpQKMNHpQKMM:W7Blp2sspARFbhVgNNHpQRNHpQRM

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3781) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\APIFile_8.ico.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\gadget.xml.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent.png.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kabul.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_ring_docked.png.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\gadget.xml.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent_partly-cloudy.png.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\DVD Maker\sonicsptransform.ax.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\clock.js.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_disabled.png.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\flyout.html.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jre7\bin\fxplugins.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Mozilla Firefox\installation_telemetry.json.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEWDAT.DLL.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe

C:\Users\Admin\AppData\Local\Temp\6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
"C:\Users\Admin\AppData\Local\Temp\6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
39KB

MD5
c41d231fd150e7e7bdb6548cd1bf06cf

SHA1
3536cb420a1a47a47d151d6c9a63cd304bee6db4

SHA256
ab002a078ad1525088b1829949580a55fb93f55451fe0b572e40fb66e938541a

SHA512
0a04c9789f5f699e2b8833a1952a17e8d9683f70f0b79f573939810e1057c749d5dc8c2edfc09e35c92cd4bb7470ffd2b6dd4ae2e558e6521f1fc270bb363330

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
48KB

MD5
870b1c575108fa357333cbc6cbf62415

SHA1
e53b81686705a05b352a905d61b1f717b7e3ba9d

SHA256
a2386c5856cad0fb3deb22c9314a42d9b804447303b5a909ed1b2d009535da7d

SHA512
ee46514ad085bd208a8f495130f8279e4df7d1ea78533f787a204871b7b6bd7cef13876244c9ea5ba5f502af3cb88a736434333610c0581bdc9f4e4c17ab2fdb

Download Submit