215d3469107969e265af632fe7a8f9e66fcce94fe005d21f4385b590ace225d6

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

967bc82428f80010af0b3bdd4b076b60N.exe
Size

39KB
MD5

967bc82428f80010af0b3bdd4b076b60
SHA1

c7ddbc28dd5594ca54ac2377865175fec90f443b
SHA256

215d3469107969e265af632fe7a8f9e66fcce94fe005d21f4385b590ace225d6
SHA512

88dc48fd5763e9dd12299fc2046d9cbf1d2c314e3a36d47959662d4d0cae81b08314ca2c468ce64758e463730c1c651bced9d3f9a689a7e4be15ed364c6b17d2
SSDEEP

768:/7BlpQpARFbhS1012oN+OiJGfOiJfoN+OiJGfOiJM:/7ZQpApjbKbc

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3322) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_ja.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guyana.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thule.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jre7\bin\ktab.exe.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Mozilla Firefox\mozavutil.dll.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	967bc82428f80010af0b3bdd4b076b60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6CDT.tmp	967bc82428f80010af0b3bdd4b076b60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	967bc82428f80010af0b3bdd4b076b60N.exe

C:\Users\Admin\AppData\Local\Temp\967bc82428f80010af0b3bdd4b076b60N.exe
"C:\Users\Admin\AppData\Local\Temp\967bc82428f80010af0b3bdd4b076b60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
40KB

MD5
5c758a859544f400df3c402103e8b5d6

SHA1
bf8de9bca0d3105ce3acebe5a9178f22146929f8

SHA256
aa7333d3da4288ec5b79a7d30c34eebdb0215a773a138c59804411b351bdf587

SHA512
3278dc80a58e075af35e2ee59d43d2090fbe7b9497c11360fc061f3e66e4932905e5a9c400f2c79c3dc9dbdfef61feef855b35c7d5338998f48dc358ccdccb01

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
49KB

MD5
a00cae5faade1301e620b8af10338926

SHA1
44e7f4963b2a8c7330c9367056bedc468b5db501

SHA256
a3309a639c8d508d6d202ee9a409cc1c0877835dab0fe122f8cb48afd831795b

SHA512
e194c7f74f3f622779b0ae761dc2a0625fc06ec33cdf82ac99dd749eb5ce41f0a30be5e0a1da5e94fbde8082cd8e6695dd025b140d3d6d9516d520951279ed3d

Download Submit
memory/1000-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download