593af8d985bc72320cf5fcef5c1007c25c42537073eef79b90bb41f4c9726e73

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f61b54897e6dc2bd016be69e1fc24510N.exe
Size

51KB
MD5

f61b54897e6dc2bd016be69e1fc24510
SHA1

791067261714d0d576f1a078812a57826d6dd182
SHA256

593af8d985bc72320cf5fcef5c1007c25c42537073eef79b90bb41f4c9726e73
SHA512

28b3475ce78834751266cd36b2c8ccbb8b6b0e8eff464baa7adcc4e937d781d2294812dfa8c039b92ebb08d31f967b0afe2cb0ba087eb70ca34018c7c23985c5
SSDEEP

768:/7BlpQpARFbhn54fmiy+3BVr54fmiy+3BV6njYw05jYw05Kq:/7ZQpApmi6n8wBws

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\de-DE\Mahjong.exe.mui.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\core.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Efate.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-options.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jre7\lib\zi\PST8PDT.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Mozilla Firefox\dependentlibs.list.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\SelectRemove.aifc.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe
File created	C:\Program Files\Java\jre7\bin\ssvagent.exe.tmp	f61b54897e6dc2bd016be69e1fc24510N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f61b54897e6dc2bd016be69e1fc24510N.exe

C:\Users\Admin\AppData\Local\Temp\f61b54897e6dc2bd016be69e1fc24510N.exe
"C:\Users\Admin\AppData\Local\Temp\f61b54897e6dc2bd016be69e1fc24510N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
52KB

MD5
aa1401a00d0c299726aa1941c37817c2

SHA1
2bb7305f10314debf3d193d53504ef5c81f15a3c

SHA256
f5537f999bb03117c4862c942e9d05127a8cc4b30888cbe0a3f27be99cfb785d

SHA512
18b88b950b0aad922d3caad0cb47f2bbaf796a336c03c0d5ea61b39f8e60178a314ec34ff2011b1ea6fc0b64bdf8c9f3b0b7be5ea8a4dab00fc7b7f1e2e6f8c4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
61KB

MD5
98ce79e910c355082853a3156e191ed1

SHA1
8e1b73f8dfe9faaddd30b9d92615ac4aeedadb83

SHA256
f6c45e603735d32e7da95280934975ea121a47d594b89325590329d90cd8b4c2

SHA512
631fcb4f111130fd9d3fe032dc5d86d94f48a813f6e0b410e5cb34760b38c93ba4eb57479052e363b6c09dc440f5d668f246932209c24115a1a06ddf89538793

Download Submit
memory/1716-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1716-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download