dcb669b4dbc642eb89250545d1d290cf179c40b337d399961db3b68364e985a4

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8994ea158bdce297eb52459136d288c0N.exe
Size

42KB
MD5

8994ea158bdce297eb52459136d288c0
SHA1

5d53e6d9a9ba6c7bdc06ac8c49a944b4587abbb5
SHA256

dcb669b4dbc642eb89250545d1d290cf179c40b337d399961db3b68364e985a4
SHA512

2895ce1eae3c11cecad44a0de75cdbba56a7e0dcf2c43989d739416a469fd5f1db70d926872b75442ff7b0cea9b87808175ac0da99528a8168470e57aab6dd5f
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJL4ZQZM:W7ZppApBULcfpHLcfpyDX

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3334) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qatar.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Mozilla Firefox\installation_telemetry.json.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\index.html.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\SearchEdit.wps.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libstats_plugin.dll.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Accra.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	8994ea158bdce297eb52459136d288c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	8994ea158bdce297eb52459136d288c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8994ea158bdce297eb52459136d288c0N.exe

C:\Users\Admin\AppData\Local\Temp\8994ea158bdce297eb52459136d288c0N.exe
"C:\Users\Admin\AppData\Local\Temp\8994ea158bdce297eb52459136d288c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
42KB

MD5
b42b1151af9e24b79b9f423c100ab893

SHA1
2f9ad59b47ca863a84e4df0c689ece41237fa7c4

SHA256
40a5a5b67d36b8eee9d6c1526e86df23c27d3a56ec247c50b216c57d6b802cc0

SHA512
3dae82cb5f9f906664489c0e065c7e1559445a7d570cafb1bf73da0554e7ac87426405fadc322427f38f4f1cec9ae4bc28c07926cdf8f27992326f553a5d0941

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
c913d149fb04b29b5f25eb5b43431d28

SHA1
12cfe4ff937c26f116342e43711b3ab2615a75b4

SHA256
a5d17474132acffaeab8925b401b57f7699dbf069be84f2f711139c73dfadbcf

SHA512
618e706c7127c669757fdd09c64c502a348b9ba4cc651d6138bc3b342ac0353f13d1d1599ba2aef6f474eb80f4fa018b30082f00ea3c24293e4c608369c41eeb

Download Submit