7a582afe708efef28e4a79ffa9a05f40d8aa76f398d30303e22a92361cad9d97

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 05:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

627353bc074938e2aa29c7d9e6653b20N.exe
Size

74KB
MD5

627353bc074938e2aa29c7d9e6653b20
SHA1

a2ba6f23ba82839524a5183e33da1e9439ee86f1
SHA256

7a582afe708efef28e4a79ffa9a05f40d8aa76f398d30303e22a92361cad9d97
SHA512

347dd16ba29e43cdead80a3dfc896b8adb6b3f20c52ea105280c30773e35c2facbc2d2b78d10fc10386749c8fb98b421b1a35c43ec5d9b9ea1fd5524f746a1dc
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7YNNdNpyI8yIU:6e7WpMaxeb0CYJ97lEYNR7kzlSU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3268) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\PST8PDT.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Perth.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Mozilla Firefox\dependentlibs.list.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL.tmp	627353bc074938e2aa29c7d9e6653b20N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.tmp	627353bc074938e2aa29c7d9e6653b20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	627353bc074938e2aa29c7d9e6653b20N.exe

C:\Users\Admin\AppData\Local\Temp\627353bc074938e2aa29c7d9e6653b20N.exe
"C:\Users\Admin\AppData\Local\Temp\627353bc074938e2aa29c7d9e6653b20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
75KB

MD5
51f626c83551ee044d7647b2fe6bd55e

SHA1
41cddb91476b6a888c4d51da615c7f4ce76aa463

SHA256
08ee645eb5a95b485eb14e460c723f04d1f268232377366ba5de24fb07558903

SHA512
64472193d6322d4ff5d13521a4ccd630156757d4ca4ddf2e691f3246846e5a70d1c02a1ba9de23d69aaa0859bc0b3100744bf8c8c2b2e423c44a1326d5740ae2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
84KB

MD5
6b708c87fc0442ce4c51a754defdc03f

SHA1
5f50cec1629a0445cc45225d5e269982239d703c

SHA256
040e40a517f32f0f57da51775138a7a43d6e83f567ce18398c8dec5d2af80274

SHA512
96b8726ddec6b921d90db4828084e8fe59b1854664aa2ed62f8cba029a2d8fe78959aa458543bed42d7f109815824d299aa952017cbabbed490df0b5fa4534be

Download Submit