f8d7e79b34f89d9935eaf13ce3c38a712dc73e8b0d1f682a788bf8baf6ff5633

Analysis

max time kernel
119s
max time network
21s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbf36d35b75316a5451bae74588e4d90N.exe
Size

69KB
MD5

fbf36d35b75316a5451bae74588e4d90
SHA1

1355430ab8ee28f3933dfdfa2a67012ea1c2baca
SHA256

f8d7e79b34f89d9935eaf13ce3c38a712dc73e8b0d1f682a788bf8baf6ff5633
SHA512

ef72fc8e727bcc40821e8cbf0c57a6837059d6116d744d2227ebd22325d8df714a90575207d9bf1f37859417a8c8a8fafe7602e0c2a8f7d6acf370b4d2adf023
SSDEEP

1536:W7ZppApwEwnmJARJAaXxXNJdkCKPuJdkCKPSSZSo:6pWpUnDXxXs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3153) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Mozilla Firefox\postSigningData.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jre7\bin\javacpl.exe.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-favorites.xml_hidden.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	fbf36d35b75316a5451bae74588e4d90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbf36d35b75316a5451bae74588e4d90N.exe

C:\Users\Admin\AppData\Local\Temp\fbf36d35b75316a5451bae74588e4d90N.exe
"C:\Users\Admin\AppData\Local\Temp\fbf36d35b75316a5451bae74588e4d90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
69KB

MD5
2350fb400b24cf74ec67e6520c6a4a64

SHA1
275f82715320974cffcacc135e3e7d6c8e61a355

SHA256
1d514fda2b664e984b2ef353d8f90bf0f0a800eaeb2ae04d948303874930c7f5

SHA512
b74cda2e86a1fec28e8a802c52db15d880395bd3e404d05ebc0b3f6044f2308406b571166b24520021c367ea7e5a5220361a14237e68c46b0d1548b063267656

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
78KB

MD5
c00087cee8154468487949b8cd81a575

SHA1
b713a8f75682c2b721691a87d9c223e8b4c7be6a

SHA256
b517fae1fbd41c9b973cabd3cadf078fafcd176cde277e4027e1ce7905b4a724

SHA512
3268f31993805836adb19be2d42109511345deac7ba9130c51101e0a7c56765c80f8eab5992e7ed9365bf7dd1172f890852ac7f8aca4caa09666ff46dde5b063

Download Submit