30d6df380ee308e2e06e3eaa9b928c87b7ec331304cd6d1674ec9011ab3ee4ba

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9fc478fa69fd9de165e47f5958c55d50N.exe
Size

79KB
MD5

9fc478fa69fd9de165e47f5958c55d50
SHA1

4825f1b3f16f1e3d3509c2e37c11dd105f7cd381
SHA256

30d6df380ee308e2e06e3eaa9b928c87b7ec331304cd6d1674ec9011ab3ee4ba
SHA512

793c299d1301fca511df347321fed6a575c63001216b38e225f3e7d90300c27491fe43e568e05c91602d6cb2e694571f534ace847bf9a104324da982f1dab75d
SSDEEP

1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlfPmV:6e7WpRaSljZPmV

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3062) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jre7\bin\ssv.dll.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jre7\bin\zip.dll.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Juneau.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\DVD Maker\Pipeline.dll.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jre7\lib\classlist.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Windows.Presentation.resources.dll.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	9fc478fa69fd9de165e47f5958c55d50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9fc478fa69fd9de165e47f5958c55d50N.exe

C:\Users\Admin\AppData\Local\Temp\9fc478fa69fd9de165e47f5958c55d50N.exe
"C:\Users\Admin\AppData\Local\Temp\9fc478fa69fd9de165e47f5958c55d50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
79KB

MD5
4ac1a14e06ed12f27aef71c21810b289

SHA1
12f7b58bb45ffc5ca54f186d0e7fa58d8941ee39

SHA256
00f52beda3c16f07ca49c9266f263040f7c2dd734b45071ef5ddd81ccea22a1a

SHA512
efd4fed30fb72c14d69cc90df64c52a3eac33334c3d12f6fd5acd09d1efc7e832297059584b4b4ee7ed9937a741660f145c805d329d0ab85ef9c786f2b2dd440

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
88KB

MD5
2570afce48dececa011b09a0d68864ea

SHA1
4cdcdbfa2db19f69132a91df412f0ff0b55cc1a2

SHA256
8e4f65abef2fa61a2418ecd69d4c138515b109bea1ee175a94810aaae371bd2a

SHA512
3f56fdf77fcd012742b0fb03f45d1e286c3b69aac8e33cc95df7d23644f4e3be6a58445f75c475045c8e626be149bc2ecca4c54b615814cecae34e0e6c0e7a7d

Download Submit