d4da98058b295c7c4d419f117164dd8cc901bde09f2edebd6dd5fce26fdfed76

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

062043129bc661314f872e3b2bc00440N.exe
Size

92KB
MD5

062043129bc661314f872e3b2bc00440
SHA1

410d6e811c68efda7a1d17b534c71ca2c3f4cd32
SHA256

d4da98058b295c7c4d419f117164dd8cc901bde09f2edebd6dd5fce26fdfed76
SHA512

6d7b4f4aa9d770e68c826713c3aba82ce67fc4d4832641e78bbd9b69ec567534f1ba34d879f5a03d3f5ad3f2e5ef68cedef8ecd12cdc068466c9c155b886fb2c
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWSY+:6e7WpMaxeb0CYJ97lEYNR73e+eBSWSY+

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3065) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\bin\java_crw_demo.dll.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Regina.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\bin\glass.dll.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-actions.jar.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Monterrey.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\bin\dt_shmem.dll.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.RunTime.Serialization.Resources.dll.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	062043129bc661314f872e3b2bc00440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	062043129bc661314f872e3b2bc00440N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	062043129bc661314f872e3b2bc00440N.exe

C:\Users\Admin\AppData\Local\Temp\062043129bc661314f872e3b2bc00440N.exe
"C:\Users\Admin\AppData\Local\Temp\062043129bc661314f872e3b2bc00440N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
93KB

MD5
3fad987ed73e248f8e0bbaf32c00d592

SHA1
57d40a8cfd4a081b0e1bea1deacbc6cef29fc930

SHA256
7ce14b6ad666cee1ed035a4d1a164ed07760627b4d9984376f5551c045656176

SHA512
a7b5bd539253f30ab24375126f007270a052547e6c52caf79f533d298b8b2d493f8df01136f5e4b2402f6c140cfba5e35a96080b7761ba0b46327ac55d13bedd

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
102KB

MD5
18b0d29567258df1342380c292e2754f

SHA1
e190a14096475c5fd5fff4ab7bcc8782fa5aa5b7

SHA256
4e17b05f53d57f3890953a44c607739c18a80537c6efa8fffa9eda96852e25cc

SHA512
908cdff065a25478ea1b9a9d971761119a293fba67b2b9232579ef8f466a53d0c17b5139f410be406837a3241e61d8d9fc79e840c42dfcf290d10dd3cf1b85f6

Download Submit