e0ece19c2d33f8cb0de09439ccefc3aea6ce1aa4465f27b638ccc16dc8e907e0

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 09:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
Size

43KB
MD5

73e9c5f9bf2ceb320d3a21a6c7e2db50
SHA1

492d0dca9db303f6ab27d0db60b0f40b3c88f925
SHA256

e0ece19c2d33f8cb0de09439ccefc3aea6ce1aa4465f27b638ccc16dc8e907e0
SHA512

f38c1fcc81bf9f1f0d0a2557cf616b1378e046663e1f06610fd9e801629487d92c396104af21b845819681ae6d4d7b9ba6851cc5cadffc856ba9a6f858231e16
SSDEEP

384:GBt7Br5xjL7lAgA71Fbhvt3Gb9CGDb9CGBjUDXV8gcjUDXV8gu:W7Blp9pARFbhOCQCPjw

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3357) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bogota.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jre7\lib\logging.properties.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Almaty.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\management.dll.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Phoenix.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.tmp	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe

C:\Users\Admin\AppData\Local\Temp\73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe
"C:\Users\Admin\AppData\Local\Temp\73e9c5f9bf2ceb320d3a21a6c7e2db50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
44KB

MD5
3b09240d9ba7c5c07dc890f3ec051b36

SHA1
bd6cb6f6893d2bf90bd19ed2ab8e57308c2913ba

SHA256
5fdbb7a6bc829e83c67c3b78e30895b71d8076ad920a948d0ec2c79f5912c1bf

SHA512
ea45ec4a1fed0cdbccd2d1a60ea3d4a7297dbe1c4f519f4bf37c1e5a1ba7cb62e69a9afd1016a29e1c4177c770fc0d8bde74cdb0a8dbda534e464fed17fb24ab

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
51fedacfd00ae489ba327c3c77678f25

SHA1
bbda547a973e26f400bea0286ddb40e827dffeef

SHA256
e2fb2b06ba92a202145799af38cee890e7cc17cf1b819c2f036d6bb8109c36a5

SHA512
c3efb69bdd4994b04cedaff368380502d67d02f91456ca49f889d7f6ac725ec2fafa2f07d4a9e10eda478ae4e3fafa7e5e7875f2ac7005fdf24d07c9f83d985e

Download Submit