49ef782237cecc5bff7e3e2bcf836000322513fa457e64fe11f5f05f951b4a43

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
Size

94KB
MD5

20ebc18bdd545f20d3a29a26e3aa9fb0
SHA1

8219df6c9d5c36820dbeb7f706a2965062799f56
SHA256

49ef782237cecc5bff7e3e2bcf836000322513fa457e64fe11f5f05f951b4a43
SHA512

d18e30c916bf5caadf6cb9fc3668074cb5aab11199367e3b1e31fea16fa3538be60876675d961c005670b39df750cff0768f7f377d91203df50fdcdef6ef41ec
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBK2LUf7XQex2D:69WpQE0zUzXA

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2922) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tijuana.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Inuvik.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-execution.xml_hidden.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre7\bin\deploy.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe

C:\Users\Admin\AppData\Local\Temp\20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
"C:\Users\Admin\AppData\Local\Temp\20ebc18bdd545f20d3a29a26e3aa9fb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
94KB

MD5
752c4d5219c5b7d2adde914bcfbf1720

SHA1
2d5def7008bf03c710d0e1df70ba281d82d44fb5

SHA256
00a8e46ab7a708d13e66153a488706c5d97507e6730c326794b329c66dd1ebf0

SHA512
d60c2e1b7104c6f56bf82434d94f27a2ae4807a0972fa7f64d204cb011540b6dfae7c0f7405babb5970243cb8c228fb69abfbca4318c0e6d49c19e3bd1354a51

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
103KB

MD5
6546b758fde407176cc96d306914215a

SHA1
1568acccb9f381bb79a8573cf41721f600c8315c

SHA256
afafe2a29084fbecb3fd5629c3ab9a70601bf2a36b610272dd2082d8010d932c

SHA512
db6946010777db30459c0ff6eb0cdbfa2005b3e0d8b17b475fadf07dd09305efefd72355d5063d029d69e184312215b68bf965ee787222eaea7b9b29f228c8c4

Download Submit