74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
Size

353KB
MD5

535f694b6554a95d610857645f0bd04b
SHA1

83eb3981d560e45ae6ce18f7eaf8967102495b74
SHA256

74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94
SHA512

9039dcb96aa49ede7447dfa1ad876a7110979d1e4721998c83ac16d4ca9671c515df6650d15727da99f42e35c15e065231c61a956dc470333ba29ddd1383feda
SSDEEP

3072:6e7WpuwfSkhvFpe+Zd+DjFWGDqkUJxsUYJwgH:RqFZht3d+b/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2808) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\bin\prism-d3d.dll.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Jamaica.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\bin\npt.dll.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\lib\security\javafx.policy.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Microsoft Games\More Games\de-DE\MoreGames.dll.mui.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Troll.tmp	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe

C:\Users\Admin\AppData\Local\Temp\74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe
"C:\Users\Admin\AppData\Local\Temp\74ee7e4bf30b5880c2a86ddd357a829072f384a1ef46b80aba545a7d967c8b94.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
353KB

MD5
753cd8c4b89a4d6aa63d1eb85d0dbe44

SHA1
2dd0c8e594d2f6bd44d98e8d239990b734ab0978

SHA256
c9b4e03d29ea9f7e552776754833e0de34466466b36a4ae6dcbcac2051241a91

SHA512
c878a1f32d350a53313c016d97ca565bad9a8d4308a845b3d1fb8662df16b655c1a0eef625a54399829cdcb11c0e60a3ae4f18ea0446cfe455ac42dea4912a56

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
362KB

MD5
d3b1bee2b94d354253cc1bbc22a3a95c

SHA1
84178c08288e2cbf1de56b4bc49db99d01c7a4fd

SHA256
a126b561633b6d537ccf391d84c21f2c992d225fdcdf06520bca887c5572dfa1

SHA512
2b3e7d5a64a3d2afdf4644e95143df588c2667fb3dfdd2008ad29b66130afe61eec52650a56f17eac9fbda85d9c5e8d5c96deaef6cdaa387bc315865d07b598b

Download Submit