2bfb944d37d644f528a0da71a0a3c9f39582a91ab4b28e09f0af32c2b9232a4e

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

946c8b1e1886d6a62cb9d89c8ff857a0N.exe
Size

56KB
MD5

946c8b1e1886d6a62cb9d89c8ff857a0
SHA1

548824b66858004ed1f2c1a49f3f66f0a6d449b3
SHA256

2bfb944d37d644f528a0da71a0a3c9f39582a91ab4b28e09f0af32c2b9232a4e
SHA512

d103f642e7c655e56c80f278a9fbad7a3c30e51ec6e5b0eca5752d1642e7dc08da50f73624850e65e47b664ab9413324cd4adc3adc034b800612e3aa0280ec49
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw70EXBwzEXBwOvEJcvEJf:W7ZppApqvZvC

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3249) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Madrid.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Mozilla Firefox\nssckbi.dll.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.bfc.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Mozilla Firefox\freebl3.dll.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	946c8b1e1886d6a62cb9d89c8ff857a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	946c8b1e1886d6a62cb9d89c8ff857a0N.exe

C:\Users\Admin\AppData\Local\Temp\946c8b1e1886d6a62cb9d89c8ff857a0N.exe
"C:\Users\Admin\AppData\Local\Temp\946c8b1e1886d6a62cb9d89c8ff857a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
56KB

MD5
9d861789eb98b60f0bfe6256c87648e5

SHA1
660a1e00b69da3b7c5b6ced35ee04041db52dfa8

SHA256
727217c33d0f03080d544a3e8f124b86f8ebb2af53ceefcf064de4a3a0bad88f

SHA512
cffc8b502641ca9f3ed076b689f537d811e9e22873ff062b6024829d85d8588a12604d7817bc25e7016157f7106e984dbd8a7168ef6127c8255e5a3ebcb3f280

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
65KB

MD5
d054ea36bf866ed0eaf30d4ae5951608

SHA1
bb8136670d720041cc9c0b7f1d07a6cce8607383

SHA256
a45c09fbad9fff3c70cb4ae2ea8be15be8198a27fc992e89c0eb0fbcf1aea144

SHA512
692df02dd7e3dd77f345647cb4f5b658499a6e9bcc64624ce86cc45292a9b3145cc535e67ea96a9fdcdeed0fab824aa21ba1c0986dc6ca00f75442f268e65ec6

Download Submit