d3a137d92cc766d44214b351d4355846121d4f5760cd4cb22f4d27a05c4e1eb8

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

618d1964ce89af7c0a6365f32402cf00N.exe
Size

59KB
MD5

618d1964ce89af7c0a6365f32402cf00
SHA1

e1d4b19391df358fa22568dfc640e65e47f8a9e4
SHA256

d3a137d92cc766d44214b351d4355846121d4f5760cd4cb22f4d27a05c4e1eb8
SHA512

54b73dd54f99d02609320a51c13b9872749f1f7831d36bd312001f446008c294d4efd8b96d4529e86547c45477bebe7e728d0c92dc19316876e03627bfe73d2f
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcF+kioCHo+ioCHodYI:/7ZQpApze+eJfFpsJOfFpsJk+k9j+9jr

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3196) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre7\bin\nio.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\VideoLAN\VLC\libvlccore.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\vlc.mo.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Microsoft Games\Hearts\it-IT\Hearts.exe.mui.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre7\bin\ssv.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre7\bin\libxml2.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Accra.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp	618d1964ce89af7c0a6365f32402cf00N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages.properties.tmp	618d1964ce89af7c0a6365f32402cf00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	618d1964ce89af7c0a6365f32402cf00N.exe

C:\Users\Admin\AppData\Local\Temp\618d1964ce89af7c0a6365f32402cf00N.exe
"C:\Users\Admin\AppData\Local\Temp\618d1964ce89af7c0a6365f32402cf00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
60KB

MD5
b9b20eae4d40dfb526956495e117f4d2

SHA1
d6a18451a84b492624d3a51011bcf475672e33f2

SHA256
f77c9f66a21eb98fc63b78a77455e3f6b1d8f932e51b1c72e7088b4b9ca12542

SHA512
540b2512d8a864cefcb5787084d2d39a1181231f58d65766f21da30168adf377e55522956fd9f5ecd0dba80e9744ebc772e04a43aab29100dedf8d48ec6a83d8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
68KB

MD5
51189205056495a5dbca32412f20751e

SHA1
3d84bbc11e462f7c6b1c958234224ec4f12104be

SHA256
4bc1cf75a2f5c1b8d5051b01dc34d7b8aae86e4aed4939b2a4559991a37b1948

SHA512
fce27e57bde69e8532d16af8af673902ce688621f27f904b71962d2e3de1665e7dd5ea058a7b597f0640b9da8063a3d7df3fa9f8887d9bfc3cc3d3151ba90e38

Download Submit
memory/1496-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1496-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download