993961199ba9c605ee7ab2cf80c6038dbe11f80298611eeadee127bb87eb5573

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8795cc9f2ceed61094819e1f1c9ab360N.exe
Size

83KB
MD5

8795cc9f2ceed61094819e1f1c9ab360
SHA1

7a3cea5d730b769d8a12abf73341c74ac6f6aeab
SHA256

993961199ba9c605ee7ab2cf80c6038dbe11f80298611eeadee127bb87eb5573
SHA512

614455dcccb402be677740d858e824b627ed1904da9548c507afc6b53975909d1ba809f20707617c4129d3473c620418a0ba03113e1b99bafb161a15eb4ff49c
SSDEEP

1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7t5m0m698+Q+kFWF+ctFXcVrW:6e7WpP9oVLQthbYY9oVLQthbUrt7t5mG

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2883) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Zurich.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\ImportPush.mpeg2.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jre7\lib\resources.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jre7\lib\management\management.properties.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Jamaica.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\DisconnectBlock.lock.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jre7\lib\management\snmp.acl.template.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\RequestFormat.xps.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\SearchGrant.wmf.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp	8795cc9f2ceed61094819e1f1c9ab360N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8795cc9f2ceed61094819e1f1c9ab360N.exe

C:\Users\Admin\AppData\Local\Temp\8795cc9f2ceed61094819e1f1c9ab360N.exe
"C:\Users\Admin\AppData\Local\Temp\8795cc9f2ceed61094819e1f1c9ab360N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
83KB

MD5
1b301addca24cc238b9ede210425d4ac

SHA1
421fc434efffd619930c346274b3c97011ed5c79

SHA256
ee62390627d53ff15440f2ffe22c9fecb4699fcce06ff327d8fd0303b0cf3f24

SHA512
5ccd94ab2bbabcfa9eaa1f6a8312ba2c1eddaad63ca8873d2092576280f75bc976c155b99fc56d386022b901ac965f4e1724395be6dab61f184b0378f847fd46

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
92KB

MD5
923397b4258a9614f784ae56851b0897

SHA1
b7d113870290bdef2ea048c3bf8ed3175600edef

SHA256
c440662d9258cd5b35f5fe1ef8453ab597f1d01718aee87e12454c2b2120266b

SHA512
69df1bd4344ea470c854b4c712fa53aa22c2cebaf50ba28106f5050abbea237c3cc089963d6fdb00ed94c248299aef02826ff3b5d4438ce81aa6c97d18814a6f

Download Submit