0d5b4168a5e4abe71a8f34e904300c87ccd5510520faa6674081908ede2d95af

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

236731f0e06533c914cdb4cefde03140N.exe
Size

79KB
MD5

236731f0e06533c914cdb4cefde03140
SHA1

8146384fbfd9a66fafffb64c90626d7567b20bb4
SHA256

0d5b4168a5e4abe71a8f34e904300c87ccd5510520faa6674081908ede2d95af
SHA512

ebe7cea5d19b748f815faf6d591c811e65173d8af3e51ddd6da24e8be9f60ea77bb26d21a15f368b9c468deaf99a54a956f7fbee826adcc0da4756933f7ba5af
SSDEEP

1536:W7ZDpApYbVK4vx4PN54PN4OHepOHeZSF79:6DWp7Wf

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3181) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre7\bin\jli.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\GetSubmit.AAC.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qatar.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgzm.exe.mui.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgRes.dll.mui.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Hobart.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja.tmp	236731f0e06533c914cdb4cefde03140N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	236731f0e06533c914cdb4cefde03140N.exe

C:\Users\Admin\AppData\Local\Temp\236731f0e06533c914cdb4cefde03140N.exe
"C:\Users\Admin\AppData\Local\Temp\236731f0e06533c914cdb4cefde03140N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
79KB

MD5
1c3b42ecf47bca092ee6d4f36e0448c1

SHA1
26a3a630738e77bfd0ee60e9d80b4ecf9c44c7d9

SHA256
bcd620b3065d3b18eb0c50f4487d278d8ad375b7c1021680fd39b10d7f8c5770

SHA512
f1b0bb0d15ee427b6ad06eb5f21782ac6cb8df4ac8e461ac6299b98f690a48405e39af5f9459d2290817979ed7db70a4ffc71d1b1d0ead4a0513d88d149cd8e9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
88KB

MD5
bb9eacd4eaf00eefc50d381c740e1b05

SHA1
1c9a9ee187f849e8a0485db1cf4a2ae49cc1341b

SHA256
f97a2f0095ac7b566c0f629893d009a185f3556ad6761edeea959ce9508761eb

SHA512
e1aae92fdb26d900540154c77e5f12c2aed45adcdc822ab0316e7b4f71ed9bc08a820ff2d123545ac73b4f89dec671c8e2778b24973ecc7dc985ed0a026fe799

Download Submit