24f16531a268d3155fcec58a76d483875a93a73af9b093823a7e189ecb930473

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 05:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
Size

90KB
MD5

1f9ff00f069aa1c7d4dfe9964cbd6740
SHA1

37eaa01ea5919d18722f4fa47e8de673d0764d10
SHA256

24f16531a268d3155fcec58a76d483875a93a73af9b093823a7e189ecb930473
SHA512

59ffa7904e4dcead8bda1b23953a36461a3c37f166ff165d10f5763cbf0a511f9f96fd68987f34f559e19039c5ccdc321e82a6f8ea86016f0e2538789685b854
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEht:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsE

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3151) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Internet Explorer\jsdbgui.dll.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f9ff00f069aa1c7d4dfe9964cbd6740N.exe

C:\Users\Admin\AppData\Local\Temp\1f9ff00f069aa1c7d4dfe9964cbd6740N.exe
"C:\Users\Admin\AppData\Local\Temp\1f9ff00f069aa1c7d4dfe9964cbd6740N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
91KB

MD5
f1fec973e6dc3a58ac7f89ace5f851fa

SHA1
161dc25ca31db8fbd02b60dd94edd8c9dbe79df8

SHA256
78430cb7c91b8eacc0e2b4ed8bbe1740e0dfcd721572946c921b25c8cec208d8

SHA512
712c11bcd7ec72f24fddb467e3ec86d986436ec13091117d35bcdcc9eaa09cdb3bcd646be42463bc010a3e6bc7ade26fc98d5b3273cac42e1eeeda667140ed5a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
99KB

MD5
71ce13412bbcb5f955ed6bcbea1c3869

SHA1
a614d6786d652f1c341609928e8cf7dd215de626

SHA256
c507b6943202407e6a9989f9a7912c34f9ee3ecacc450205b3bd3251b74dd74e

SHA512
27886f65044a667e8d2659a68f333f0633504d9287d5985fc9ef930b26c8763a98cf3e301b76d81b3b3b4162ab755b571b2bf978d943661995ee83704ac2798e

Download Submit