7954ed717b2e8c15c6d5b87fdc904715cf41611fa433a2f6a2970173224aade8

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76a9ca3d31fcaac01bc0d426954f0a20N.exe
Size

89KB
MD5

76a9ca3d31fcaac01bc0d426954f0a20
SHA1

467e8796065e4ee44710b76dcc29081bb8ea7989
SHA256

7954ed717b2e8c15c6d5b87fdc904715cf41611fa433a2f6a2970173224aade8
SHA512

4a4db0301863a269f3c0c935f4a5a5bd71605c5035da0971f8dd50aca24f323a449d3002e27d49516b1ad3b77f314d4381b1d127caa2c65c1ed03d4d60f5d1fb
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSW8:6e7WpMaxeb0CYJ97lEYNR73e+eBSW8

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3065) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Ojinaga.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Manila.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.tmp	76a9ca3d31fcaac01bc0d426954f0a20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76a9ca3d31fcaac01bc0d426954f0a20N.exe

C:\Users\Admin\AppData\Local\Temp\76a9ca3d31fcaac01bc0d426954f0a20N.exe
"C:\Users\Admin\AppData\Local\Temp\76a9ca3d31fcaac01bc0d426954f0a20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
89KB

MD5
dc6f708741a23510c2f52e52c4dee420

SHA1
fda24c25cd8af3dffa26d760c78816bed1c56255

SHA256
8996dac8aa886876662064c424f0565a7e9a0974f0e06f955b3cebe2dc6a06d2

SHA512
dc1e5c2f94866898acdbb19bd34a570213edd5b7ac132120fd09756cf3517b547b44528e92a4b950bd76cafeceb9f97296eb041d0ddcd03495983c20529d33f3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
98KB

MD5
c9ee7b7e14bf429dfece245eb7e3dbd6

SHA1
7124895cb63a15b93ccef75e2bb00edea49b2b00

SHA256
dc8a90f2912114740771ef1820edea5c61453a85c059038c9c5e313e7e1b629a

SHA512
6689123112307f5d07aa120fe9a687fbef22ec63796061ad12b9332b70ec2af16617bad89cfea941f7dea0ffb69520841cd6c02fbfec026e95ea54f584d6f409

Download Submit