3263b8dbcb055769b8eb2a9b67dbc3235e0c1cdf14b53e2395dd0f527cb444ed

Analysis

max time kernel
120s
max time network
117s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

756dd4bea5e65ae181fa988f27183f60N.exe
Size

71KB
MD5

756dd4bea5e65ae181fa988f27183f60
SHA1

895426f2c9b73bdc7810b02e92d9444abe40bdc6
SHA256

3263b8dbcb055769b8eb2a9b67dbc3235e0c1cdf14b53e2395dd0f527cb444ed
SHA512

1937990eb84c961671ddc9314a0b0b71f05ff6dcffde473032d8be25dacec8ea8f51a122eec0613fc24cab8393c38e06692176f1bba1a8e28be967607d6cf741
SSDEEP

768:/7BlpQpARFbhtF1XxXEhk8ssACJfxRLsACJfxR9aZ9cHS/gc6zJgc6z2babK:/7ZQpAp9XxXEhJwk9mSvQNQ8

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3254) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Chagos.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\librist_plugin.dll.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\WET.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Mozilla Firefox\update-settings.ini.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.3.2.jar.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp	756dd4bea5e65ae181fa988f27183f60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll.tmp	756dd4bea5e65ae181fa988f27183f60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	756dd4bea5e65ae181fa988f27183f60N.exe

C:\Users\Admin\AppData\Local\Temp\756dd4bea5e65ae181fa988f27183f60N.exe
"C:\Users\Admin\AppData\Local\Temp\756dd4bea5e65ae181fa988f27183f60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
72KB

MD5
028ea080ed23fbb1af86d9ac15599083

SHA1
8488a80c3fdaae4d48a6e2c8024a079c4f6ed64b

SHA256
68a103fadacf2566b3965238dc52c27ae82581e55e2e67a607e122ef09586b6f

SHA512
70c451ec4f886b919a2e6f6dd4a30233c64c22fabe392c6e64c9f8afe02da0599deb92382d31dbc89e39b183befa129375d2430eac66b20ce568254e2c290aba

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
80KB

MD5
574b10e6ca119fa87007045916a5dc30

SHA1
3ca47e81a7d3a54d01a0d1449d2d55fe5b35708f

SHA256
3d749b524c9d4e4922e03778a9e9f1265794c8fb8935cdda282f68fa79e7d720

SHA512
6cc1e7052fdd9c2727355f7e7d6583346639f4f3c602ea10b19e0fcb85fe516b25bcc8ffaaa65aeb0001722446c0cdb37c49c1803daba72d1fe4aec41da44abe

Download Submit
memory/2708-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2708-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download