e7d84b289548f63065147aa5739742ce75d5a616ec1e31b9c986dc05f8f3faff

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2324e5920118eac749c421b4ab75c3c0N.exe
Size

85KB
MD5

2324e5920118eac749c421b4ab75c3c0
SHA1

56dce1407ed7c41e7a411a44d3fceae444803081
SHA256

e7d84b289548f63065147aa5739742ce75d5a616ec1e31b9c986dc05f8f3faff
SHA512

0731c14527dc04c1244a81af09716ec85a2bceb77535a146604e280e6c9b7246b8d206bba72943e87690da6b67df88f3683c275b49ddbdd030dceaa08f0a38b2
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKggy:69WpQE0zxgy

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3015) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_ja.jar.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\COPYRIGHT.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\bin\jsdt.dll.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mazatlan.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santo_Domingo.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\Chess.exe.mui.tmp	2324e5920118eac749c421b4ab75c3c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	2324e5920118eac749c421b4ab75c3c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2324e5920118eac749c421b4ab75c3c0N.exe

C:\Users\Admin\AppData\Local\Temp\2324e5920118eac749c421b4ab75c3c0N.exe
"C:\Users\Admin\AppData\Local\Temp\2324e5920118eac749c421b4ab75c3c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
85KB

MD5
b9c2acf48c69e32f7f8574d3d7812d25

SHA1
d8803f92ebd186e9648459ad0dc69cf6e93985ea

SHA256
18f4ec6202b8efceee80650564c76afb6cd24a118e117926f2e7dfbef31a8dcd

SHA512
347e6a7041ad2caa7920a7568e5dc31b8e7f1adb093c6192136bc26822ca8f83a4771ba4e6cc1cb206de7152a98420ceb31cbec152171f356fdd73c7f796a4a1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
94KB

MD5
c28678b56ddb8dc6d976c18fdfbb3c1d

SHA1
f217415c021c5a95aeff63bd155966a689a8b46c

SHA256
19d8040a3b9bc9424142961070299a8197be8c531abdeba98664938023219d66

SHA512
4c7b7e7b5d88824d5475278aecbe38010138dba66e8c4cd034dcaebf3b239e8c2b6a7583da9b96f32818428db598f7be1d5a6dc65a56ecb56be8f60e6cc831d5

Download Submit