c9b7c097394c70549f8aa57f42cfb2cb599d8de488d239bed5aa30b9ac0e880c

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

569285c9c9ee6f88a611cfa195aa0480N.exe
Size

72KB
MD5

569285c9c9ee6f88a611cfa195aa0480
SHA1

e9fd2eb3c41e19ba9c97b55d73adeb3cd9f4c023
SHA256

c9b7c097394c70549f8aa57f42cfb2cb599d8de488d239bed5aa30b9ac0e880c
SHA512

a6af1fe870f92123e4afe99c538fceff10c27573c3df52f859cc1e749c53e1816464b5c249330e31b7ec98420e7d6ad2ce4da7976a8b896f1ce7b11d62e63e37
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZvm:6NLWpCZIzjwHw0

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\St_Johns.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\CompareSync.sql.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jre7\bin\javaws.exe.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	569285c9c9ee6f88a611cfa195aa0480N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	569285c9c9ee6f88a611cfa195aa0480N.exe

C:\Users\Admin\AppData\Local\Temp\569285c9c9ee6f88a611cfa195aa0480N.exe
"C:\Users\Admin\AppData\Local\Temp\569285c9c9ee6f88a611cfa195aa0480N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
72KB

MD5
de5a6d8bacf47fac66e96751fd6fa36e

SHA1
568cf6e48af5dfdabe34f0cf614b254e37f474a3

SHA256
f00e9732ab36c6f0f33f85b90764534d137a5532bba6a230a521955e3a8d69db

SHA512
54fe1a4eb1631bdcd85edb94e50cac4e0ae880a8ade91c8969ba805f22a7f843b45c4511ee214607f0ba2252b26228f020e22bdfd9dea29a0cc0057e0605978e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
81KB

MD5
6b2c3d1d98b4b92e3c6d7822e592403a

SHA1
21fac776afe349f94c3b136e3cc25c669b900b4d

SHA256
cd5fde13cfa089ab29ff677ef5cb4420c00da768b1341e22a64661506ca7b5ee

SHA512
12760516120d9b1c564606158087a8a8d1a321f508749d833db038fdee5f9abf5e38d03ffb2ccf218b885330234c1e7d7a4b50e90712a16284a1fcb8a6b63d0f

Download Submit