94d7e7501156011f096a136614b9de86e9ac2df6bd6745d248dbf47fc70222ce

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb9c951b890a396b5f76dc9f6fee7350N.exe
Size

45KB
MD5

fb9c951b890a396b5f76dc9f6fee7350
SHA1

c40f04d9aec61cd4fd688f28a3b769f09235c4da
SHA256

94d7e7501156011f096a136614b9de86e9ac2df6bd6745d248dbf47fc70222ce
SHA512

00648aeb21541d36ba9908232aa3c303ed1eaa74ff1f409fbe9d3f1bb51a070d892edac545f72ce7dca45e31c0a9bbf106684148ce8f9d5287ee5dfca9bf65e1
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFXpK5c5khwRDThwRDOKnKT:W7ZppApBULcfpHLcfpyDA6swXwBKT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3283) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsdt.dll.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jre7\lib\jce.jar.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-favorites.xml_hidden.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chicago.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp	fb9c951b890a396b5f76dc9f6fee7350N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb9c951b890a396b5f76dc9f6fee7350N.exe

C:\Users\Admin\AppData\Local\Temp\fb9c951b890a396b5f76dc9f6fee7350N.exe
"C:\Users\Admin\AppData\Local\Temp\fb9c951b890a396b5f76dc9f6fee7350N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
46KB

MD5
a501346d1133f13e5192fdbd1e1e2df8

SHA1
de9932d1f62044b51de637df87763f513e0698f1

SHA256
402588ead90b12359400946567245b0e4b5d157edd1b7091d0f59cefd804d0e5

SHA512
0f466ebde63bbb2ff3fe50dacc82f6c3f917d6253e1624da04ba2bcab022c467c84444a32cb6b860e30d595bd9bb9d1ed70e21a79109260548eca0fa612ee9f5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
55KB

MD5
e3f3e7e73f0052579adf3f88e5066466

SHA1
92a3dfc75cb4ef68d6e586eb55538e0d16054f18

SHA256
0617869f6a7ab4007872a7b272e2d93eef539f0d6b085d2fa7416079a1ffacbd

SHA512
8bba638ff1e9213440452d444167d1bd2cb13b82c5de66e3d4bded242fe674a599ff9f1b2930926918404273e73029693f9a7b1e50235b2b7f5f0532cc838d7d

Download Submit