ed6a57ebdec1e1c5414bf39fc7009b0826bea2e893ac1c4ba982d64c106ef1d3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74c285df0cbe66aa82796f4da18a5190N.exe
Size

35KB
MD5

74c285df0cbe66aa82796f4da18a5190
SHA1

a1c12c1217ded8d2554bbfac2e21db1448accf97
SHA256

ed6a57ebdec1e1c5414bf39fc7009b0826bea2e893ac1c4ba982d64c106ef1d3
SHA512

aad4b0d803c4da71e6524010e73bde6f6f0b3d8ca8ee09e166eca4f8a24e0d9cc50e5e7e98013e9aad1735f7a4747db9dfb9be9c268d1785c40dcffa9bf55b9e
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltt:W7ZhA7pApM21LOA1LOl6At

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3269) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Microsoft Games\More Games\en-US\MoreGames.dll.mui.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Zurich.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2ssv.dll.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnoseek_plugin.dll.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp	74c285df0cbe66aa82796f4da18a5190N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74c285df0cbe66aa82796f4da18a5190N.exe

C:\Users\Admin\AppData\Local\Temp\74c285df0cbe66aa82796f4da18a5190N.exe
"C:\Users\Admin\AppData\Local\Temp\74c285df0cbe66aa82796f4da18a5190N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
35KB

MD5
6319e3f7183d5de6730a89821a33658e

SHA1
288269f32c1e03b130ebc474b3f07cde9b03a38a

SHA256
6698dbe33bdd828b99e172c56ba3c858c1d39cec1d6800c1db7dca6fcb656e21

SHA512
f7ab0f1a9d062b0a7deda1ecd73196db460f9045d35e11fb341160988373e44ea803e811c22a6741a9449f95f9107a1fba6c4dfe2a8010e839823b2acd1585b0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
44KB

MD5
afbafad1bb286c252b6dca28757a9c69

SHA1
d5f4f3d15412bc7971027057e9f016e72adf698a

SHA256
ea055940c51c84109e0f555909d94f6624c4610e0759c7c0445916607e597fc5

SHA512
aa4a24bc56b2d17fec618b21ec02772b829666fc9ed3af2b653d62f256d76a107603541e6e523ee8eb32d78b12ad6afa36d8c054ea53a9ad078d548e28c4b19c

Download Submit