8a701f4f937aa456b5d966686fc27f410e0571239c180c0f5427656be3858862

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96ec54a9dade07f64e367e99af255460N.exe
Size

44KB
MD5

96ec54a9dade07f64e367e99af255460
SHA1

12ede0e20d72393880176bedb4941997d1021e7c
SHA256

8a701f4f937aa456b5d966686fc27f410e0571239c180c0f5427656be3858862
SHA512

15b9ba318501be68fd9418cd287ff962e0d7e514e10c7337b5f3bc448007ec263e076d604a263221732aa0969e8ef53bdc6078ded3a895b521769a52edfa17fe
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0IN:/7BlpQpARFbhNIiJwsJwwnZN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3279) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgRes.dll.mui.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayman.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jre7\bin\JdbcOdbc.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jre7\bin\sunmscapi.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.RunTime.Serialization.Resources.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\DismountLock.potx.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar.tmp	96ec54a9dade07f64e367e99af255460N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96ec54a9dade07f64e367e99af255460N.exe

C:\Users\Admin\AppData\Local\Temp\96ec54a9dade07f64e367e99af255460N.exe
"C:\Users\Admin\AppData\Local\Temp\96ec54a9dade07f64e367e99af255460N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
45KB

MD5
8828dfe1c565080066c88917a9349ac0

SHA1
ec2b04827668d6770f5035288ac22ca7c02cfba4

SHA256
7d957e93691f3c705d32a39c94e8763109387b8f0f6f1ea9ce9e07bc44adecc6

SHA512
971694d015592bc1fdb8412023406fc2219bbe046be28c1b76e46ce44a839d0a5b99e656e97ff170c90edfd20af23b36b5a433f133be5b9cf3ee08a0fa09db6b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
ff95730247d69092e4dc477fb9fac2b6

SHA1
8e1a9b36077423bd7bc11687355d599b646eed15

SHA256
795225ca8260842f2932e92c44f2cde685028d84e6bf25999b0aabddc1990063

SHA512
8e558be0611e5ace9c16cd887ddea83ad351cd546167a7acaafc5b7a980e4625731f6f22b867a9b5444b242b63bbd1742ac9a8eaa3c6bf790674526708751022

Download Submit
memory/2320-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2320-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download