7ba2b96892cbd177778a4b382716f35603692f18f1a334e0078b122115058d60

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c938e77d67a28fd5d754b32be920c00N.exe
Size

51KB
MD5

2c938e77d67a28fd5d754b32be920c00
SHA1

a07c84c2f3bfc6ca8decf96a880585781d2ad924
SHA256

7ba2b96892cbd177778a4b382716f35603692f18f1a334e0078b122115058d60
SHA512

662d2d3100ed58339c5feb4c1beab263e6430afdf9d7dc4619cc1779066281ad26771db279ae1aa1ea58e8854e946c22d66dae31ce170dde523b573697d46710
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw70EXBwzEXBwD:W7ZppAp3

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3125) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Windows.Presentation.resources.dll.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Accra.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Noronha.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Mozilla Firefox\installation_telemetry.json.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jre7\bin\java_crw_demo.dll.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Mozilla Firefox\libGLESv2.dll.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Zurich.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Java\jre7\lib\plugin.jar.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll.tmp	2c938e77d67a28fd5d754b32be920c00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	2c938e77d67a28fd5d754b32be920c00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c938e77d67a28fd5d754b32be920c00N.exe

C:\Users\Admin\AppData\Local\Temp\2c938e77d67a28fd5d754b32be920c00N.exe
"C:\Users\Admin\AppData\Local\Temp\2c938e77d67a28fd5d754b32be920c00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
52KB

MD5
d486dc9ee48c31d97aeaaac50c563a7b

SHA1
f6c59358ccb7bb84b72f2efa4cdf971c2df41e64

SHA256
0185602f117ef46edf1b2617e16a64f8306ea8e0750906ab2b59b6e0c4e3dcc1

SHA512
55d1e0508ccd57e70f86cbd6395f4d7ce85ceb8211237d50863cf8bbe318360ef89161c6b03f43f7cc3d55b735e2ae8105bb9a08582187e289ecf5107388d1d9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
61KB

MD5
b884f8571e69272e362db50071f47af2

SHA1
bb291bb3d6abe911df1318447fb1d1c5f0440654

SHA256
643a7114195ab6b24570cd4fa3ebc71f42843010518c2e451bc3dc909db55cd2

SHA512
3cee9fb5bc5ed70b5b0b33fc4eb95eeeeefbee21476f872192704a107808fb2810f2039eece171988ed48d76687fb7e946522902dcf2a5794f647e2976ee7404

Download Submit