7ed5dea4ebfddc5ff2ed75e590369ed1b63bba6de5a3b87fc422a595129940fa

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

70da20b6f33a89cb5331e84c901b1a00N.exe
Size

36KB
MD5

70da20b6f33a89cb5331e84c901b1a00
SHA1

ca20ca088d9660b01dcee07332f4a14a9bb9847c
SHA256

7ed5dea4ebfddc5ff2ed75e590369ed1b63bba6de5a3b87fc422a595129940fa
SHA512

60dc030ae6214e7754ac9c37692e4facb4a3c66c9c93d52f3d90de52fe2269f0bc354073123026fea8a74eb1542e7e840ca888965568219941c508d55e9c0b1f
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHhpqNaYcJaYcmR3g9Ik:yBs7Br5xjL8AgA71FbhvsDYcUYcO1A1Z

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3291) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\SkipUnpublish.wmv.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jre7\lib\javaws.jar.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tunis.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\DVD Maker\Eurosti.TTF.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent.ini.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.tmp	70da20b6f33a89cb5331e84c901b1a00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70da20b6f33a89cb5331e84c901b1a00N.exe

C:\Users\Admin\AppData\Local\Temp\70da20b6f33a89cb5331e84c901b1a00N.exe
"C:\Users\Admin\AppData\Local\Temp\70da20b6f33a89cb5331e84c901b1a00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
36KB

MD5
23f31c342ad95c750562006dc4c5ad7e

SHA1
d17791f39cf4452781aaac5c7a7781c0799ca1e0

SHA256
6ddabee03b96b502793426d0e2798385e3e4ee2d03b9371d8fdd5d46901735a1

SHA512
0b968e1fd0a379fbddf7f3e2c8177610889ec03b73f786de6ddd6b18960aed047b229d162dc352ebdb837c976159b24ef89d82efc4c472324e653437e1314993

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
45KB

MD5
fc17dde9e1eb07551539d066212b7c78

SHA1
f8a1ac4f109a6a57d1dcd3dedd787dda602c13f9

SHA256
dbe84a4a76c591ef28c2ffe33749a8c6ac43835636fbda9dba699c293151fcd7

SHA512
6989def0bb056aee04bc36bfbc96a13483fb0cb1a0c286c94d1c75882b4315f7a1f4814dd3c784fdd0b888723f6bbb9932986a1680866d11a0ce6cd91390c58f

Download Submit
memory/908-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/908-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download