bf7eabcd2a9d3157034e7d764098f76507b6d60d2d8ddf727c4a3cd86e5e4ac6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11930d4256ee3ccac0512c66fd573700N.exe
Size

45KB
MD5

11930d4256ee3ccac0512c66fd573700
SHA1

5dc98f9b3f814858689483c39bd6b5b78f6f1913
SHA256

bf7eabcd2a9d3157034e7d764098f76507b6d60d2d8ddf727c4a3cd86e5e4ac6
SHA512

c268927244b398641ecd309ac8810113fd12dc2c801d5ce90201dcad59ba1a0e872997f81d923c54be63b712d093ed96b4aa819636ba5f0db1c478fc58254686
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltIIRIUI0n0uI0n0q:W7ZhA7pApM21LOA1LOl6AJn0Wn0q

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3074) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jre7\bin\fxplugins.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\README.html.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\dkjson.luac.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11930d4256ee3ccac0512c66fd573700N.exe

C:\Users\Admin\AppData\Local\Temp\11930d4256ee3ccac0512c66fd573700N.exe
"C:\Users\Admin\AppData\Local\Temp\11930d4256ee3ccac0512c66fd573700N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
45KB

MD5
d7539fe33a65bd5f05e33e900b1cecf3

SHA1
ae90d949a6a7a6b496890da0b1711bf7086d7584

SHA256
38898b56a3ef52802b94cf5316fe26d42a2e640ecd4e34a2016082a722a45ac8

SHA512
84e53f1a7f48fb5f3ab8300c063fa4aa61c61a81ef539cf63c9f74027374c76a7e1bab8e3f0f7958fe0e8d810169a1e17561a1fa414d8979a272ca1fd055e29c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
bd39af7faa8b790aebf8ff9eed468b49

SHA1
b690165442465cf39ddb6b95723791dbadd0aedb

SHA256
eb79ca69f6c82dfe28befe4745a01b6b0a14ce03cca87c00e6388cffeae31004

SHA512
e21811bbc27ac697962fbac29bf5d34044ecb3dedd309c94ab8710dafb1f917e7fa5dc923c6939dc55b0a2770d16c7049bef989b8e17f979bc0aaf68c9ba87f6

Download Submit