7d5f90dd78c91358d536b6641828e900ada40091bd6557738d5792dc4c55d00c

Analysis

max time kernel
120s
max time network
15s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 20:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9961328ed210b0f8b6359818beb5dc00N.exe
Size

78KB
MD5

9961328ed210b0f8b6359818beb5dc00
SHA1

bdf2e13a24ea46b84826a300f0ad470bcd22f1f9
SHA256

7d5f90dd78c91358d536b6641828e900ada40091bd6557738d5792dc4c55d00c
SHA512

cfb51510b9ef71cb719b0a1dce71236ed138b56b5dcb752d9877fb4405cf732008d1470aa29f1fdd5e31ee50677f7a98417f88c96914490f57ee386411895524
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEQ:/7ZQpApze+eJfFpsJOfFpsJ5DLkv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3105) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre7\bin\unpack200.exe.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre7\bin\ssvagent.exe.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Mozilla Firefox\qipcap64.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\view.html.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Zurich.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	9961328ed210b0f8b6359818beb5dc00N.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	9961328ed210b0f8b6359818beb5dc00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9961328ed210b0f8b6359818beb5dc00N.exe

C:\Users\Admin\AppData\Local\Temp\9961328ed210b0f8b6359818beb5dc00N.exe
"C:\Users\Admin\AppData\Local\Temp\9961328ed210b0f8b6359818beb5dc00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
78KB

MD5
3e5b8069df38499422b007d8c37b0e63

SHA1
ec6c51ff22785ee70e23103f8a99e6ab9e5ad008

SHA256
b0406fcd93e0d3f72527bdbf2c0ef1ccb1beab01b82ba39ff08a38dc754700d6

SHA512
88dc6f287468f461f9de73967000ed607a7910cee555027e2c4785bef8439b559f743251999e7140d8165d162e7935d96ac445238cbcdc74b904496c2106eec2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
87KB

MD5
456bba426b474512685c7f9f25055940

SHA1
bfb998861f3297fe542e360fd63540cf733fc1c6

SHA256
44d9d5f7576f7e05e7eb6552bbfdfc12d79444c51ea4acf52c304ad32f4979a1

SHA512
7e1144c3089bed41a4a67f8ddd292568281a438bbbb446ac9b6bb0a7b859d40f3633b687ab018dabdf168f4fecea6d0a898bbd5e4d54e44f1b4bce204dcdf5e0

Download Submit
memory/2956-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2956-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download