93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
Size

80KB
MD5

3e356485b739a05cb02691b07ae34c9b
SHA1

042d9b61c6e2258d26e58b6b7679a82e1ec9d96f
SHA256

93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148
SHA512

4af60cc50f913f9b37dd342233fd36144ed1fd1866ff288e1e009a86d519a78b7c3073a39190fe78fd4903ac2b4d00970b3e031590df0bf50184e51c13d5a244
SSDEEP

1536:W7Z+pApfGQ3y3RWvfmRfm9sKsSd5GT6Ssn:6+WpDfmRfmh2TSn

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3715) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_partly-cloudy.png.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_hail.png.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_ja.jar.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jre7\bin\servertool.exe.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libscreen_plugin.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Media Player\de-DE\WMPSideShowGadget.exe.mui.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\0.png.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Mail\de-DE\WinMail.exe.mui.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\localizedStrings.js.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\RedoConvertTo.dwfx.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\gadget.xml.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Mozilla Firefox\qipcap64.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Media Player\mpvis.DLL.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Beirut.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_hail.png.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\localizedStrings.js.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-middle.png.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Java\jre7\lib\management-agent.jar.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe

C:\Users\Admin\AppData\Local\Temp\93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe
"C:\Users\Admin\AppData\Local\Temp\93bd9c6421b0d143f806449cb795970942ebb35b541df275537c9fc0bb30e148.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
80KB

MD5
f283cad0d1b021645208dccf3a18776e

SHA1
1da1757bfeb5817215db3e1b2304968022519bce

SHA256
b06905be2db4462c34b542312e8efadcadabd34f580fbd4a70fb5e645ff7a8b4

SHA512
b9a5387cd58137408ea2f0ff81ee3df90397a107f25981c9db84083421e281b6de9764ab0547d0139bdff0a0cfa329e21677075e6164f2e0872749263e56f21c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
89KB

MD5
7bba04bed71596af66db0ace07ddc53c

SHA1
c98597195a82dd5959ab01d6e92176c62810e84f

SHA256
e61a43d85ce35db5f48ecebb395b7c661423284db0521619fa381090e2cf7a8d

SHA512
44f4b897aaa8159e65d4fce7f8f7830d3db673aee07d7eeb4c0dd4c22c16c70204c7b90a578ab20dda76b62f338bbbcdb337da8675a360714a3712ac8c290ec6

Download Submit