a7b1aa4a5c8ed7dcf85af88b05cc304057c83fbec28a2ecaba1dbae1a1583b99

Analysis

max time kernel
120s
max time network
21s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
Size

60KB
MD5

6aa23cba7b3f389cc1d6e0b95f01fde0
SHA1

0a78a7e86fe1766691b1004f76bed4db87d19966
SHA256

a7b1aa4a5c8ed7dcf85af88b05cc304057c83fbec28a2ecaba1dbae1a1583b99
SHA512

385319363e883826670d9e304bc2e310bd4aa71d58ec498ca4f8c5edad6874b6b52a2a53b565bdde43208974113aaeecd41d2de189fe6b7a0d0e99a013d5c1e5
SSDEEP

768:W7Blp+pARFbhBgnKL+8t8NZgo2in9u9rMBBB4F/MF/rWU:W7Z+pAp2nKLc2in9u9rMBBB62TWU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\lib\security\javafx.policy.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\bin\javaw.exe.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\lib\management\snmp.acl.template.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Madrid.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-cli.xml.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Mauritius.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-execution.jar.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClient.resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe

C:\Users\Admin\AppData\Local\Temp\6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
"C:\Users\Admin\AppData\Local\Temp\6aa23cba7b3f389cc1d6e0b95f01fde0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
61KB

MD5
b998d915d3e6ae609f0e909b5c008360

SHA1
7e13aedcc4609fc07bde074bc23dd5a384c07348

SHA256
0f396db7c87de30f3794daf5ba4b196bec6a148f5f77371fba4f67ddbb80b0ca

SHA512
1f26fc2bd8500ffc0c413f62612b2efd0b61dd46ab86d53006f5d1aeb3249144d42b618bbfab4833beeda496acfbffa83532641fd87b823933d85fdc0a30ef70

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
70KB

MD5
240c72af7f44b892512e7f70c0a51a44

SHA1
d60ca869cc6e77e3c29570bbea49681a3d04ef10

SHA256
69f0cdd96c12f559656854416b43c58c2c6d5b1f631c7b0f23a77cf2b83840c2

SHA512
1dd28d8b3b69bc2b621622b2c3642b5485b7cac91de20716a35e8b590c2ef25ef71d661ab10133f22f407351d1419f0d33e6deaf83873d3d3438fbb5f10f3018

Download Submit