8768732ba06f829ba8ccffefa49df572fcb4c412fb1df80b66d3609c462ec85b

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00ce9e6db9624cfd5d8bff859c4a2f50N.exe
Size

37KB
MD5

00ce9e6db9624cfd5d8bff859c4a2f50
SHA1

3803a0159f217498ad475b668a9a065620b44c59
SHA256

8768732ba06f829ba8ccffefa49df572fcb4c412fb1df80b66d3609c462ec85b
SHA512

1f718e896a05afad06a155f3f7651c18ba445e7a56b7b274f17955530234ea84a7d9f6b7a488611f9401d2b18485629a6ea44fd4f1eb2a95a7d8f74227415950
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHdGeqc4SUqUGeqc4SUF:yBs7Br5xjL8AgA71Fbhva4S04S

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3438) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Dublin.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\uninstall.log.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cancun.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	00ce9e6db9624cfd5d8bff859c4a2f50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ce9e6db9624cfd5d8bff859c4a2f50N.exe

C:\Users\Admin\AppData\Local\Temp\00ce9e6db9624cfd5d8bff859c4a2f50N.exe
"C:\Users\Admin\AppData\Local\Temp\00ce9e6db9624cfd5d8bff859c4a2f50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
37KB

MD5
4a734d3933df7cbe39a455f39a83bb77

SHA1
9ef37cd1eb975fb5446f9c06aa89bb0a7c6ae824

SHA256
313ad3c6944aad2f718959a7799390beef75e9593b3897c88e2a209f14d0b0d4

SHA512
6a45fbbc1f228921306b29094739635068a4222545922ee43aa8479594705fb4bc1474ced2bd7f47e56e569ff79fc82460e1e871f2569d4de0710dc3ab9b3af3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
46KB

MD5
a29eebf11be26b340f792da596033fef

SHA1
a6abe872857d25a0a0418890ea4032961b34aba5

SHA256
f404b7c444b0e6b01d70e6776b01b7e6e0e1c0e95c59bed2ddb0b85ce6eb6b29

SHA512
fccf43bea8b1c1315541aee06513580e4cc6fc468e08d3051fb2143775cb35bc4386daafde58d5d35a0041e8139737ff0addb325e54b9fbb74af7b47612ab4f2

Download Submit
memory/2824-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2824-664-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download