e02ea5b8bb7322a2a966cdca849a1c744fede1e39da13f233ca8cfefb2a6f9fd

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98ba717e93a15e570a41107292d78ac0N.exe
Size

58KB
MD5

98ba717e93a15e570a41107292d78ac0
SHA1

8d39d69015403dd2daf18c819bb3d8e675fd37a0
SHA256

e02ea5b8bb7322a2a966cdca849a1c744fede1e39da13f233ca8cfefb2a6f9fd
SHA512

8dc3aa4a9cf71e8585dc912cb9fde67b3046e04033edd5d4adc442b2c6380d559ea758a05ef6cb67c6c0a096d9e15ec5a64415e5a3d23bd365d6f1070b4dbec5
SSDEEP

384:yBs7Br5xjL8AgA71Fbhva4S04ST1zfXz1zfocuc7WR+Rq:/7BlpQpARFbhS101TZXzZ1WRyq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3300) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Mahe.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Jamaica.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\RequestPublish.html.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jre7\bin\dt_socket.dll.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jre7\lib\tzmappings.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Mozilla Firefox\libEGL.dll.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jre7\bin\deploy.dll.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jre7\bin\javacpl.exe.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp	98ba717e93a15e570a41107292d78ac0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0.tmp	98ba717e93a15e570a41107292d78ac0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98ba717e93a15e570a41107292d78ac0N.exe

C:\Users\Admin\AppData\Local\Temp\98ba717e93a15e570a41107292d78ac0N.exe
"C:\Users\Admin\AppData\Local\Temp\98ba717e93a15e570a41107292d78ac0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
58KB

MD5
ad55ee9cde7d36e97c15a2a3df44cc7f

SHA1
997e2d562ac0d347979ae7bbb53c8ffb8a8b62bc

SHA256
d06008062478787db7cc08d467374a0a0bd7e4ab3fc0ba2184e3a3f70348893b

SHA512
f26c11819772f14a4398bcda16ce4b9e509927d4f9317d9e9e909718a605e54a6a49d2980cd3f9af4219d934e5a8448ef4a06fa72d84aa400737017a8a3240f0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
67KB

MD5
12bef8ea3bf2fd23b75d65281afd6e6d

SHA1
a6d4e4f19fa9d70b5d44729e439df5cf1c0396ca

SHA256
e9466c5f9d15a7a74c5dc1c52558ff0cc0086abe49ce845d859b09e82c249d22

SHA512
956e8ffb5da8a37abb9ac1ffae9ac9186418c614a565a6a4536cd74034b7ef7ec605b42adba94d47f156da0d20833031bfb717084e9246a78d733d07be91d117

Download Submit
memory/2348-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download