50504b056c6a8de9609e0f1a9a15b534d428137e86398c7e1bf4d9fd22f79b21

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87f89e841c0b69303bb5f5d8465dc670N.exe
Size

102KB
MD5

87f89e841c0b69303bb5f5d8465dc670
SHA1

b9a796dcef27e2d7803783f7c1658d07c674c7b5
SHA256

50504b056c6a8de9609e0f1a9a15b534d428137e86398c7e1bf4d9fd22f79b21
SHA512

258f4d495cc38426cfcaeb7d60406d58acacee4f09e385233f226b44f45bacbd7009547d47d1d211134144cba7bd827cde143acd1e26729b1338eda24d53e490
SSDEEP

3072:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9il72c:RqlIyFESWu0SWu86jYl72c

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2854) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Menominee.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87f89e841c0b69303bb5f5d8465dc670N.exe

C:\Users\Admin\AppData\Local\Temp\87f89e841c0b69303bb5f5d8465dc670N.exe
"C:\Users\Admin\AppData\Local\Temp\87f89e841c0b69303bb5f5d8465dc670N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
102KB

MD5
70fc52bd5cc476a00231495b312b26b3

SHA1
de356af08016812dd9c6ec097cab6485b301d0eb

SHA256
67b33531959a838a6773ad2da5cd32f274200bfb6c9af18f711fd18716094b86

SHA512
b6efdde99744b4756ed12ff392d72827702ee4739ff25b6e99097b312a875f1f5beca0f8c6a2d038fe58baf87a03bf7a3adf582c8aeb716ded64f6bc58d33c57

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
111KB

MD5
9706447180eb45e635fafd4094c154b3

SHA1
68b5ef5fe865eeaaac2b4134e7ac9a0822e3dbbe

SHA256
12306cdc59a454321742bb0e3c311080163d6eada4e7f32990b7604939ac9080

SHA512
61d462a366de298c5057e29785733e13117bbef73706de859437a29448dd94a1a011a8cc61dbfe10155d251f43a75b6e347cafd06935ee56019a20d1621e7003

Download Submit