4baf095bf78123f73f19d5078c478f0fb2f32bc100d4eaaa81cc8e2e710e3abf

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2668b14d5865c9eb3a76c920fb312670N.exe
Size

39KB
MD5

2668b14d5865c9eb3a76c920fb312670
SHA1

10bc1c0471495410bbc59cc9adc4a7496d9c2a57
SHA256

4baf095bf78123f73f19d5078c478f0fb2f32bc100d4eaaa81cc8e2e710e3abf
SHA512

f40493d35b9c4f85f2fbfe1743d365c4e694cec12acadbeb47409213e108d95c020d0186adc849987a517d482db52ab0aa2035b21b3bc8104860940e8cbf3852
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1j1AJh1AJA:W7ZppApBULcfpHLcfpSo3fS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3293) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages.properties.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Apia.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yakutat.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Windows.Presentation.resources.dll.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jre7\lib\security\blacklist.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jre7\bin\javafx-font.dll.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Mozilla Firefox\dependentlibs.list.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	2668b14d5865c9eb3a76c920fb312670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp	2668b14d5865c9eb3a76c920fb312670N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2668b14d5865c9eb3a76c920fb312670N.exe

C:\Users\Admin\AppData\Local\Temp\2668b14d5865c9eb3a76c920fb312670N.exe
"C:\Users\Admin\AppData\Local\Temp\2668b14d5865c9eb3a76c920fb312670N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
39KB

MD5
08bdeb677ab35b0d761d43c5ae79feec

SHA1
876e9e348b4e79daae85006e8911177bf4e0d568

SHA256
1e122df2c258904fb9e9f94b2f63343eb7cc5f0e2515fbbe9675ee0f00443092

SHA512
7546b4fff90eca754493727eaaefd28ccd13d5214db0c01bdec11d2188c24dc69c37a09bfca9f84a57684e066981eeda58114d226f1e6d1a9db85328b531bdd7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
48KB

MD5
f7c101961bf0e78eed52db44e2d3ba43

SHA1
b17dd209fb5787eceb6ea575654b879e454440a4

SHA256
09218673694f63906b0eb865d9c61e35464cf31fca6e09b3e04ee9ecf960bc75

SHA512
46c51008578df328a0a4a13ca5c73818189fe855d23da1f1316ecd5d125ab1085bfa77714933296332cbf5ea90ee6b7f07e0a16a288ef13cc24c1ab961a08472

Download Submit