711e7576651420c5fafc983a1e875eb4c4a616cb831b6208389b50801e47d886

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5db67a510fe4e91c1c8c205c673c2160N.exe
Size

89KB
MD5

5db67a510fe4e91c1c8c205c673c2160
SHA1

607f4ad0dcd5c8c0e59a06a862bf9fe0831656bf
SHA256

711e7576651420c5fafc983a1e875eb4c4a616cb831b6208389b50801e47d886
SHA512

496b1d45169d38b659673f25ba303726d176efbb42d9b985050ce71ac152284fc609ff9626f4de1910289c4275b1669477cb7fbccd32a1216e6a5782a676761b
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBK2LUf7XQex2j8V:69WpQE0zUzXd

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2819) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jre7\bin\libxslt.dll.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Manila.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jre7\lib\ext\meta-index.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-execution.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jre7\release.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Internet Explorer\F12.dll.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mazatlan.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	5db67a510fe4e91c1c8c205c673c2160N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5db67a510fe4e91c1c8c205c673c2160N.exe

C:\Users\Admin\AppData\Local\Temp\5db67a510fe4e91c1c8c205c673c2160N.exe
"C:\Users\Admin\AppData\Local\Temp\5db67a510fe4e91c1c8c205c673c2160N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
89KB

MD5
549001eed7afa0f7ead8affd6195526e

SHA1
3a2b9f23ac48384ec9cbc732a4068b067d387a0a

SHA256
d21b1b261939cfb17a1acf2e94c9f2a4691a1837cfe5659187b92bffb74014cb

SHA512
f76990fc0f52d9067757d19705e10e427a988c563c11cb13d0bb0ef074be5b41235b276c3bdf963a08569b484d9ba63b100f7a7cc6ddbd69a827139ed7d3cce6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
98KB

MD5
ad26df133609375de83fb2223ff1b360

SHA1
46984da0da757a33a00d5cbca531228e66337187

SHA256
5f5be029550a482f8a3d5e94da8a89c92ff39545caf514a50659ad74419745f9

SHA512
424bf0a2183299cd6b6d9d6f041862075345786dbc99a06f2bb731d1e5e8e83c33cc97876a96eb1cfe20fa4e697715f9ec5abc3059636750c2ddae2da554e653

Download Submit