81b2ee8ad7826f1ac7fa1a9d4367a32a0c73fe2fb01d0930401d85e41f0cbaf0

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

672b7133a313afd9ec5178569a8bb170N.exe
Size

75KB
MD5

672b7133a313afd9ec5178569a8bb170
SHA1

9ba858230c3e0df0bd652767bff92da8f0a7fd4b
SHA256

81b2ee8ad7826f1ac7fa1a9d4367a32a0c73fe2fb01d0930401d85e41f0cbaf0
SHA512

8fcd63471bd3b57759e574f5776ce3fbcca200e63dba2a098e059bce1092403cf327cbfecf3d88efa90df9a9275829912b9e0630c80824ebf14eadfcc1535a77
SSDEEP

1536:/7ZQpApze+eJfFpsJOfFpsJ5DVSWu0SWut:9QWpze+eJfFpsJOfFpsJ5DVSWu0SWut

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3109) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jre7\bin\klist.exe.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	672b7133a313afd9ec5178569a8bb170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	672b7133a313afd9ec5178569a8bb170N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	672b7133a313afd9ec5178569a8bb170N.exe

C:\Users\Admin\AppData\Local\Temp\672b7133a313afd9ec5178569a8bb170N.exe
"C:\Users\Admin\AppData\Local\Temp\672b7133a313afd9ec5178569a8bb170N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
75KB

MD5
38cabdf587e9babf396b20ddce4af279

SHA1
2fabe87d1dca52a9a17794b7a775888faa4d3b23

SHA256
808dae9e8411bd380ba3cffcf7b08aa63c1cb00befed18b8771bc3c2a8531da7

SHA512
0dee57a4be722626359206fb98e76a8463bf24f291feb24a11543422e9e6bb418d169cc9d0aa7a7bc0561ed3860500ffa18fb526633f90fa23c1713ea8c072fb

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
84KB

MD5
2a4ded3d4df518a73c6ef81f4e5a6247

SHA1
161e8d320e4692939965e766d0937f2f157f8303

SHA256
e60dc33a262ea10e5edfce264911be92339ecd982607b9fb2ad265dab12ca29d

SHA512
44219765458a1fff2a39a612e5615b5ea65ac4305467cbc97981d2bc637b9b1b4703a12adbb92f82a3003088d8dda8914305b9ebe096c832fb6986999885baa4

Download Submit
memory/1172-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1172-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download