e22a5f44bf33de2074cb79911e4703f50f6405982ae2ecc27ce3f09568e885da

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/08/2024, 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6813db6fe733d31e1e9ba8b1cd9bd570N.exe
Size

69KB
MD5

6813db6fe733d31e1e9ba8b1cd9bd570
SHA1

21e5c8fc0fc591f8f15024f4ba52027c79cedcd0
SHA256

e22a5f44bf33de2074cb79911e4703f50f6405982ae2ecc27ce3f09568e885da
SHA512

976bfd53e60ddaa8608d596749baef70c9cb5ef74d361b1597d5dc19582e5b99d0b2394a4fbb289a1e1be40d5d6821a0ab513e2d4acf22dfd00c7cccd8b07953
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZvW:6NLWpCZIzjwHwE

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\DVD Maker\PipeTran.dll.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boise.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Mozilla Firefox\application.ini.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jre7\bin\libxslt.dll.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Halifax.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	6813db6fe733d31e1e9ba8b1cd9bd570N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6813db6fe733d31e1e9ba8b1cd9bd570N.exe

C:\Users\Admin\AppData\Local\Temp\6813db6fe733d31e1e9ba8b1cd9bd570N.exe
"C:\Users\Admin\AppData\Local\Temp\6813db6fe733d31e1e9ba8b1cd9bd570N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
70KB

MD5
dba082f852b781ff6be08224e903d144

SHA1
d7bf6870a40a54ed18063a5e998b54767f5fb361

SHA256
6b6886891a2bf79bcf03cd2da8badde8320c5b6ed135306207b83663cfb629de

SHA512
8895cf0fbd480790a69c86ab6e0e3cfe18a97d42e910d7404eb7dba638bbb73e493bdcc16b23b38b0e7cb372e9068c1f9d8f648fe0f79c7ecdde2b9b48e9f00c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
79KB

MD5
3426b0c95f50cb47e6a3a871fd3ed147

SHA1
c724b235b4ae1f47ff39057cd4f862ea342976ca

SHA256
9096faf1356fdcdff55a96e1d4a1f23c8fb80a40f58406ca03c5120f84f5a0ee

SHA512
6c7dc39348ead4d33b68b1946bec448f8e8ca68b6daeff70f010ef50360a0aa2258cc2f298932d2235dbaa50720d0e149d36cb67dcef6b8aec75e6f4910713a1

Download Submit