d9d150158cfc352154e2bfc67976935736f960ffdd94cd094a625f75b961bcda

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ec260e2b07c0f40983b84db4fefa0e0N.exe
Size

37KB
MD5

9ec260e2b07c0f40983b84db4fefa0e0
SHA1

d5b3039b79cd04971a1ab8660d636c5426a142bc
SHA256

d9d150158cfc352154e2bfc67976935736f960ffdd94cd094a625f75b961bcda
SHA512

03d81845219cc69f203766f66e6b9cea511be661f9679c7c2c88c2f5fb60ccdd088ea6775e0b700bd401a407cdb2f5e1da11e09cec8216b97d2ba18df2fd35ef
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSz2:W7ZhA7pApM21LOA1LOl6vSz2

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3364) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\OutCompare.js.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Mozilla Firefox\qipcap64.dll.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\SearchFind.css.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jre7\bin\jsdt.dll.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Xml.Linq.Resources.dll.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\London.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libgme_plugin.dll.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp	9ec260e2b07c0f40983b84db4fefa0e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ec260e2b07c0f40983b84db4fefa0e0N.exe

C:\Users\Admin\AppData\Local\Temp\9ec260e2b07c0f40983b84db4fefa0e0N.exe
"C:\Users\Admin\AppData\Local\Temp\9ec260e2b07c0f40983b84db4fefa0e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
37KB

MD5
ac92103cb1757e904c8bfdb1edae42bd

SHA1
a8988cae963b67363e9d6af5b209d3ccfdfda826

SHA256
d8e7c8c92e68ca5a6dd45d3c3eff71f1ed33768883031f498e6a879a5d7a5bc5

SHA512
8b111133774c451e10bbd88f6ec7b3f52789c6c1425130b970df94dfba2796c9593815a5dae6bdb40d3b2aac94a408be6357b91d614da98b2c76b8bd6e7ff80d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
46KB

MD5
781e36ce26fd4b0b9e5ac2390e0186b6

SHA1
3aa4d2edf844c8fda9e47761a1aa57599dc70d2c

SHA256
fb0fbd54b86ac8a25d88346fecc6977b56c169aa88b6d5856345e2b3ef8858e0

SHA512
e6c36f6468f5f8f20e0bbc6d2598e6e58dffad5107f882ce2e8f0536be5073aae78a384a4e637eb98983273f76c34ad9e8c786225bd5d15cae3dbbc0c0190791

Download Submit