c6c5e016dc6e7a2da2632ed55fafac6e2b23e2a5a24f2d7d5912f273f0c901cc

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77743c73980c15d1229a8ad3914f70d0N.exe
Size

50KB
MD5

77743c73980c15d1229a8ad3914f70d0
SHA1

a41292ef8455b3a44a9926a60d9ec0129ef63a77
SHA256

c6c5e016dc6e7a2da2632ed55fafac6e2b23e2a5a24f2d7d5912f273f0c901cc
SHA512

7e69804b8d4cb2ed0a44ba175914ba84cdda6cfa4ce172b5017d3c3a40aaa84b8c2bef2db9ec18339327b8aa3ca0af22ab3b249ca4d483eecb2a9bae60903b00
SSDEEP

1536:W7ZppApBULcfpHLcfpyDoAQeLeAeLeJ0z:6pWpBwchcwDO

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3324) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Perth.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\GMT.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\JoinImport.AAC.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre7\lib\classlist.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Mozilla Firefox\mozglue.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Galapagos.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre7\bin\javacpl.exe.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	77743c73980c15d1229a8ad3914f70d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77743c73980c15d1229a8ad3914f70d0N.exe

C:\Users\Admin\AppData\Local\Temp\77743c73980c15d1229a8ad3914f70d0N.exe
"C:\Users\Admin\AppData\Local\Temp\77743c73980c15d1229a8ad3914f70d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
50KB

MD5
1e89e239f5d89afbd841d10916916eb5

SHA1
02bc4b15b9587e070fab60fe666ff53cc95009bf

SHA256
a106367191b8485ecd3bc9d680161fc334aefbf98060c9c4f486e5965663b1df

SHA512
063022cf4fb59480210dce5013b0befd1b03b0ad904a5d4cb1629f729de5e1decfcb7765ac9cae5ab2184fbb5ca4d1f1feca13704b3ddaa0b5763e6a0e5bb3f2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
92dd09587c45313e6dafe0eecd8b5fcd

SHA1
0ed701a32ed927ed82436366546748276f2b112f

SHA256
ddb97d5a9711ae18d4855bda8ffc52ee5a1bcd2ad10696317c7b0e42e8598cad

SHA512
e994d636e40e3893379defe7766c012ad4e845339b02d72195313bd78b27f3703b6f19ef28f0a05c2825122b9b659ec5852595b43953f58a04fa0a715bb69240

Download Submit