4b488ffae46ceff32cd4d9af82f52667e04ba2e6f601637fe0622ed183ed4eb4

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

200a4e9f73e5a0494f42244feb1de580N.exe
Size

44KB
MD5

200a4e9f73e5a0494f42244feb1de580
SHA1

8863d4e97f24f6198b75a3ee546e54be385ce06a
SHA256

4b488ffae46ceff32cd4d9af82f52667e04ba2e6f601637fe0622ed183ed4eb4
SHA512

7c7956dec9039c47368ede2bfb8d5146cc37015263019c433744f76a775cc989ce55d1e9f366d136490aad0a19dda8e6e60f91d1eb35cf670cff25ef3493f2f7
SSDEEP

768:W7Blp+pARFbhBgnKLMWK9WKD2N2P7ZM7Zp:W7Z+pAp2nKLRKIKqoP7ZM7Zp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3388) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\London.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Makassar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jre7\bin\ssv.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jre7\lib\plugin.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libpva_plugin.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-execution.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\SplitInstall.i64.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui.tmp	200a4e9f73e5a0494f42244feb1de580N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	200a4e9f73e5a0494f42244feb1de580N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	200a4e9f73e5a0494f42244feb1de580N.exe

C:\Users\Admin\AppData\Local\Temp\200a4e9f73e5a0494f42244feb1de580N.exe
"C:\Users\Admin\AppData\Local\Temp\200a4e9f73e5a0494f42244feb1de580N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
45KB

MD5
2e486b7991c692e4e3cca9c0d349a714

SHA1
29f6d676442f5abf36c5af4d66ef4dd163bc429d

SHA256
0d011bdbc6369d62221662d2f41662fa10472ae587290e0bd55f42bfbfd7824b

SHA512
b0b29d78120eaf5508d1a8971313f3548839df912083de0b82e857d80d683d6b54819a4fc1277f26ff511c7d8e732a9df5a3fe65d792c24566974ee5e18964b2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
222c11683e4393ce0f1f5848c0aee429

SHA1
4d74a2edf1f18cfd4208495d1c18dac5af9d3072

SHA256
18ce10928bdfd8a0799f21e491c3f4b0d35c0e02bafb3ee7f02c4886df57c45b

SHA512
1d13c634b6f25dbfdb0b1b9bd170943aa94501f4f6dc4680abc20a49c6ff3d9d17a2eea71c1f2bccd066b8ad8c00d9fcf6c009ba6a2323765cac08495ad70d06

Download Submit