6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
Size

42KB
MD5

8e045a42e0d0b1b3df4739095df1ea52
SHA1

5900c92d6999fba6b58671a35ccfdc7f8e4c31c7
SHA256

6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f
SHA512

2bfc40324113bb135ade9161f5fb7c00eb8063294ce8d4c412bd8cc9f88297064efe5bf8303eb317965615cc890510682741fb08f666d814ff3c6078d1cc6cd6
SSDEEP

384:GBt7Br5xjL7lAgA71Fbhvt3e4S04SdHaQx+QxD/LuV2LuVa:W7Blp9pARFbhs101MQIQYLa

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3764) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jre7\bin\server\classes.jsa.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\currency.css.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Manaus.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\37.png.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jre7\LICENSE.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_h.png.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\21.png.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yerevan.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\localizedStrings.js.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_rainy.png.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe

C:\Users\Admin\AppData\Local\Temp\6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe
"C:\Users\Admin\AppData\Local\Temp\6e917518ef9f6438d82408ec71331623e8f6fda16688ad2812d782b009a0ee4f.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
42KB

MD5
1c91f4391230bcfff64efe751517ddc6

SHA1
e89bdd51e5b8bd8690ee4d78d9ddf85b26c9f1c8

SHA256
67d04f33171ff59bccf21c3757b8405e8cdceead5859d8b570ceef5b65394cca

SHA512
3d80de3a08da1b0f978f9813131272060fc2d802490f12ad6224842100a22493624fb8ba9ac984ee40905d8a4e2d7726f2c515e672c9bc803c3852861e2e79ad

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
314f782fcd7df8f2abd0a159417419d2

SHA1
72324bc7336a0fe82d5a397d992b9f6e6f79166c

SHA256
f42b195285a7c41d80807368cdb77aff9d8737423631282ce9218ef0cc69da24

SHA512
0b8a12bbc0e7ae5a38b8d30f26ae8ad9280791c87e851de622853e0762abfb0437168942baa3e9abae86ad0b7937ad7b24dece608e0e1dde2f7877f9778af4c3

Download Submit