9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
Size

75KB
MD5

0e888153e547287a90ed1f7f0ba30592
SHA1

5b8d05ae9e5a2038c0ef1d651481e13d006776ec
SHA256

9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8
SHA512

79f6e4fb21af704032257dbc223147e61acb4a087dfde6708d79cfa7908d05982eef0d5f5279f3df0539d0929fcfb27d38e4042a16aaa1f2db288c7795608ce1
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEi:/7ZQpApze+eJfFpsJOfFpsJ5DFmF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3739) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\gadget.xml.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\sidebar.exe.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Mozilla Firefox\mozglue.dll.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_right.png.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot_lrg.png.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\currency.js.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libx265_plugin.dll.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\cpu.css.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\grayStateIcon.png.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_dot.png.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\gadget.xml.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Journal\de-DE\JNTFiltr.dll.mui.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\settings.css.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe

C:\Users\Admin\AppData\Local\Temp\9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe
"C:\Users\Admin\AppData\Local\Temp\9e2f6ec995efad452abff2e6aea67161782b3ab4afb9eaa3204967a5bd46c5e8.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
75KB

MD5
e561f765757d795a93e0b6313aaae410

SHA1
c484118773562d54d1197193f348feb8cba5394b

SHA256
b897fcaf298f91e99afa178ffcd6f210402816d04033168f21ed9c32940608e6

SHA512
3575362312a6b9466ca9f1614ff3db7570ab39e521913ab2437a2b84693483c6f89940ac9ff3ce5f11cfa3a1132a1f70fba9a36dfb23e915b1788c4c83ac7b17

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
84KB

MD5
69178031ef36801c9f8458e3604c5cde

SHA1
577158cf12e65b6e1ccfd5c57c5806627da3f4b7

SHA256
81e8ef9c1ad0a8559c2b1ee84ac4f52c373e690d9402bd94d92ff5615e81a0c3

SHA512
79f09285b2a93277b2aa44a848cee9c9e909d196e597825d7cf88d525b7732228a9357821778e9f38f62377cdff9311a5518e5d67b6252be39d92ebb5ea76fb1

Download Submit
memory/2112-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2112-658-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download