69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
Size

45KB
MD5

545e79db43186880feec1ec78dda605a
SHA1

db95dc2ae312883ba69e89a193cff176076b3227
SHA256

69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5
SHA512

62af13ef321116f425de7b57bc25a0769fc9951b83ca985d6a9afd2089ce611b4c9934a2cca00cd386941eda74fe4df58e37c77a78c471e89db6b17b1f1ab091
SSDEEP

768:/7BlpQpARFbhefnj0Tjfnj0TPuQogKO4iJfogKO4iJXGK:/7ZQpApouADJ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4125) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jre7\lib\zi\WET.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Windows Journal\fr-FR\jnwdui.dll.mui.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_up.png.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_left.png.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\micaut.dll.mui.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pago_Pago.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Windows NT\TableTextService\ja-JP\TableTextService.dll.mui.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\Microsoft.Ink.dll.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\WISC30.DLL.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_left.png.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FBIBLIO.DLL.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPSideShowGadget.exe.mui.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Windows Photo Viewer\PhotoBase.dll.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe

C:\Users\Admin\AppData\Local\Temp\69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe
"C:\Users\Admin\AppData\Local\Temp\69d6966decfb9cd313c890fa68f388f3c5bcfc80ad5e157cd46d1ced4cd3c6c5.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
45KB

MD5
0c380f4bd0de31e94ffba50ddd91f7cd

SHA1
558879bb8332507806e44ad0460a5633313eb6a5

SHA256
6e0b8ff061ba187ac6f7b64272aabd362cac3b04fa4e2c60fa9ee89f08407ad0

SHA512
c268a11d2caa6d29c0208d3b98c976d8dab028195c62f219f46dba09862d33cdb3b5b5a013bca84368d73d7f9af716fed6b601489e99c270e2cbf152ad03b626

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
7458d63ebd9a8f16f95145de3cbbdd9a

SHA1
b14d1fbe71eba082b7775946a8b88f7ca75b17e3

SHA256
053be18944b016e8d2cdb8a0ce353c807d1ff515d04d3320e0b238b18a60aceb

SHA512
0ef54463e60f242122078bea9aed9cf150596da3a422c2193e56dc7bb0cf500aaaa75a2b5983614bcf13eb177adf620d0babedec64f646dde3348f4b6b571a63

Download Submit
memory/2764-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2764-670-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download