69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
Size

187KB
MD5

5f00a2e3629e3772b4d751aa23b30db7
SHA1

1d9a6f7e96ccbd9895a62e13ebf16fe5ccc28b31
SHA256

69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4
SHA512

2daa3c4843aaebbc67113aa176182268110392aff072752514f0e60a15cae5d062e73aff7c48d345e4878caedb6b5114a0fbac55b770a331833562c9361cb617
SSDEEP

3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBgnW5M:RqKB+tOkWKR0iJ0MnW5M

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3441) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\security\trusted.libraries.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jre7\lib\jce.jar.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jre7\bin\keytool.exe.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Windows Journal\ja-JP\PDIALOG.exe.mui.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Halifax.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe

C:\Users\Admin\AppData\Local\Temp\69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
"C:\Users\Admin\AppData\Local\Temp\69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
187KB

MD5
d0e66072f26d77971b1db19ea7154309

SHA1
85f600d5bef254de43f17a80179d4f1dc6af95b1

SHA256
16c81c4e137c56d3251e623c17bff37d86eba828af01d526f647293e705b9440

SHA512
56ab9dd264b39e99f66a2e09ab5bf80a60ef4e4af8fe7e72d49fe86524644e95cf066876ac44147deacae88e902303abbc19059de6e4220b1ea4a2f6e5eee13b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
196KB

MD5
7eb833728540dca498ba8ad2d32795c6

SHA1
a49943efd976795abd428d1361007417c0a001af

SHA256
c7e0fb397e92ab549d0232f9d6c29161bfe59f5722b6f74c7eb244b51f740144

SHA512
2a420722d503444fbc69e240747e69dd79c5e0dbc3518d28e4535507474516df2a7e11753913b8ab5719d1096e210fc40b43249014dfe9b9661a0206f49f8907

Download Submit