2d85ed869e902bdb74d934f6bf73a56e4366ebc68120d638a5dda509d1c315d2

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
Size

91KB
MD5

2f72816a2b9fe8eedd1e22f5ebf2ec30
SHA1

fbf17ce48e3c1cc84e2636a6e331ee332bef73d0
SHA256

2d85ed869e902bdb74d934f6bf73a56e4366ebc68120d638a5dda509d1c315d2
SHA512

50f2e8e244d0a7240cb7b62e1b62fb74a5aa8e30a31f82bc64ecf13cee10d41841a4317c9985f632f7208aa9f5738420493f36e045c971031353d001151438c3
SSDEEP

1536:W7Z2sspApGg7bobSM+t58qKcAK+j4nI4VfNgZ11PED4gJQeAAUZa0EzOMI:62ssWpGgrM+t58qKcAK+j4n7ByeFU7

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3122) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\desktop.ini.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Mozilla Firefox\IA2Marshal.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yerevan.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe

C:\Users\Admin\AppData\Local\Temp\2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
"C:\Users\Admin\AppData\Local\Temp\2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
91KB

MD5
231a0d5ae8e0f94677b928b507d0e5cf

SHA1
2101249094d044342bc4c820c8f4ebfdbb4ff89f

SHA256
427695b5ab1233f62d92cf103f1f64f06bcbae319503eb40cf9084feebb60efb

SHA512
7f1acec5d0a9f2d8f7dec3e8fee0dae9f37e54c1b90ab373b9462f1b4c7f7600e59c2284215b1a17c779fe3662cbee228ccf407d6eb7e152628ca3aaf6059479

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
100KB

MD5
d39b03ba0926b9b29f9cc54045657400

SHA1
6495521fea648acf8ac1c591ecaea7e440381b98

SHA256
6921a577666810837b276631a78b9fd376faca63ab20e94b1b1f363c4a02ed06

SHA512
19146fe3afe6c29ca9228982a333e2668bfde3e0383bc82691da8a41ffef419b538a3bc13097f6e439d01b31b8b6b80e61294a79873f896fb32d6706359d8d19

Download Submit