75c66bb6da6ece5a4309e2ddf714b440d8a76573901aebebfd0c8c7d39a8ef0f

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

08248ad7572c8b66a74ccb39dd97eb40N.exe
Size

65KB
MD5

08248ad7572c8b66a74ccb39dd97eb40
SHA1

7fca26af5690f2f4a7f88938f5a068469048b3a5
SHA256

75c66bb6da6ece5a4309e2ddf714b440d8a76573901aebebfd0c8c7d39a8ef0f
SHA512

d0ea6995b7c4f2a6fca494566617a28a9a0963c5b86a91576359e891bb44b7929457942aaf7833125724ff1dbf2ce9a71d9c30b5cb7ac2a426a54b4ba2454dcb
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/8O0Oi:W7ZppApBULcfpHLcfpX2/Nw/Nwmx1

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3133) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Makassar.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jre7\bin\sunmscapi.dll.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	08248ad7572c8b66a74ccb39dd97eb40N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08248ad7572c8b66a74ccb39dd97eb40N.exe

C:\Users\Admin\AppData\Local\Temp\08248ad7572c8b66a74ccb39dd97eb40N.exe
"C:\Users\Admin\AppData\Local\Temp\08248ad7572c8b66a74ccb39dd97eb40N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
65KB

MD5
407322c78bc7190f85f0d16d76023e00

SHA1
59821d3e73fc561781e926aa8072e932ef501d8c

SHA256
26a2e58b478f6ba03832980d93e69741cac07ccf28313ade41fe890210092413

SHA512
afe97fcd090f0f0d582aed8f8f98f986e74714d0a74630ff0b06b3080365363645c832e8efe768825eb98df0312440911ef20c90d133eb83ed2b7f3fab9c9f65

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
74KB

MD5
0ac8f2f7a313dc1aa4fa059bb4756f4d

SHA1
31aa72282398490900c300f07faea1473eca2616

SHA256
6f34757f02f9d62498885529b00b40d53be6c8f1386c9d261b66d157654b1b4a

SHA512
dd9a868265ae5134627d339029aca1116023bede77b617bc83bd0580f9e6eabb55390da271fc37a2a868cb2f8b5e6142b27f77a80dff8bb494e1cdd302479f01

Download Submit