698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0

Analysis

max time kernel
150s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
Size

105KB
MD5

8801fa82f0fbca63733c930bf1c46d97
SHA1

7bf8cf66135c9d2e5d917e01eecd4c6dee5487c6
SHA256

698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0
SHA512

bc2aefa01ab2d98e2cc81496900efcfbe7baece8fae2437f2e3ecd8e9bb31c9083dbcc346c451b92fdac88e6a6d6614ffa71e742f4951d55827cf541674a7018
SSDEEP

1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPIUpCUpiPk:6DWpwE7oL2e+efZwZ08i8Z

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ReachFramework.resources.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jre7\lib\deploy\splash.gif.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Windows Sidebar\es-ES\sbdrop.dll.mui.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jre7\lib\jfxrt.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST7MDT.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libadf_plugin.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll.tmp	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe

C:\Users\Admin\AppData\Local\Temp\698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe
"C:\Users\Admin\AppData\Local\Temp\698ec42222bf3633a7e452395e806d251f35b6eeb1894b13d0cf404b334135f0.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
106KB

MD5
217213b194cdfef21fd80ccac8b76c84

SHA1
eae659150c97552902e5bd44226310ed73f19666

SHA256
2762fb1a0261204465aeafd9b7ddeaca41513a0e2627c5829087225b98d92b9f

SHA512
1c1cd15b6fa1a504688662cf438e3406f3aa7ec1b6c6e37eb7c54c2b4b8423e3daee574593cde2db5063038062739dd4465e9b314b6e2657a69553a21fc56037

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
115KB

MD5
30d6d24f769eb6b66f658cfccb3ceeb0

SHA1
607dd0cc98b5b9a37df151c93891b2b51ab89e50

SHA256
29446e49e6a71246a103aed0efb9f9962c0a0d7aa2f2a781a18a42f94817e62b

SHA512
f746f58478acf9d1e01a4596ae1c0c4a107c7d79b5dfbd1316721090982f26b6884b8a2ac4b6803b5abde7d298405e7373f046f3fbecbba1bbc681afc689d1e8

Download Submit