b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
Size

41KB
MD5

c1940e2184f74b91864b66a32d2d77e3
SHA1

ff540e6d1ca7052236ea92fbaa405b3fb1592536
SHA256

b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1
SHA512

710cc9c32a7fc2acd4c69b342f6d10c7dc000d083f45dd02d987bb9d718b473a7e116e38fe10e3a2a0e3142376b2c4ba2c7da7b9a186bb9a5e7bd2025408ced9
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSccd:W7ZhA7pApM21LOA1LOl6vSccd

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4080) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\MountSwitch.bmp.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\settings.css.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.dll.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\PREVIEW.GIF.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\InitializeEnter.rar.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Windows Defender\MpEvMsg.dll.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\localizedStrings.js.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jre7\bin\zip.dll.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Windows Media Player\mpvis.DLL.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\RICEPAPR.ELM.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_few-showers.png.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\THMBNAIL.PNG.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\RSSFeeds.css.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_cloudy.png.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\flyoutBack.png.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent_partly-cloudy.png.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe

C:\Users\Admin\AppData\Local\Temp\b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe
"C:\Users\Admin\AppData\Local\Temp\b4278b62549921ab7e998996d044e6cd978eff85a7022b66100c5e57f2fe47b1.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
42KB

MD5
b17baa72e1dab2bdd1dac3d8799182b2

SHA1
3a8b64e2809bcf3f6b32106aa506c8582b37fe23

SHA256
354a9bbd9ff1fb9443fb133c5fb320464eb32915384ee6efbf60f6d8aedb6745

SHA512
d8429fb69923926b51f526254ccebddb5b26a409bced87d52b6b1ac54c4e99d24e485ca8b6e0b0e266bcbce7ba06310789255b42fbfccb70163b03dcbe20f8e7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
1edf482d554dbd92372eeb2602a7986d

SHA1
297e4b946df6b2cbb4f6316c0c53fee20402ccc9

SHA256
dbf201a6f4c4b80da57666b18f83fbefbebdf79722e2e815326acdd54f60ec67

SHA512
2846e68202b6b8d93ee8d23a6d7903dde3d390af3ddf44a9ff23b3a19f135f3a950774e2b7221efea055ff624e995393eefa567d3197baec069d06b8ecd1fced

Download Submit