a09d6b5d2e4e066033bb23bc68d5857e734cc5c0e687ef82e0aefbc0b2200583

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2622b3542a93d204c93f89423effdb50N.exe
Size

104KB
MD5

2622b3542a93d204c93f89423effdb50
SHA1

eb3195182d0719eeede8109723b20995037abb9d
SHA256

a09d6b5d2e4e066033bb23bc68d5857e734cc5c0e687ef82e0aefbc0b2200583
SHA512

82caa3e69eed3e0d9c90645263492afa729f03396762c2df8f08b9c4866a7d38855e06fc6c658545b9d3cd270885b5e6c2e0ee82a7ddf5df883050aaacf8a7de
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyB8:PqFF2Ie+efsim2A5O

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2877) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tehran.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Mozilla Firefox\mozglue.dll.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jre7\bin\jfxmedia.dll.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jre7\lib\psfont.properties.ja.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Brussels.tmp	2622b3542a93d204c93f89423effdb50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp	2622b3542a93d204c93f89423effdb50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2622b3542a93d204c93f89423effdb50N.exe

C:\Users\Admin\AppData\Local\Temp\2622b3542a93d204c93f89423effdb50N.exe
"C:\Users\Admin\AppData\Local\Temp\2622b3542a93d204c93f89423effdb50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
104KB

MD5
6decce8fa586f2e8d74eaf099a66af76

SHA1
0ad8ebb8f6149741298604ff8130a27dc567dea2

SHA256
d84a33a25d9343f1a89676ae10f222814ea93ce1e0834b49aa824f20e0975aac

SHA512
cc474b9c37901d9c83a62bcc7fd07d26b65a4ca12a35b5011d5aa9fc88731b73949c7cdc9a67300dcca6163639a4ce247a43a680d1523e49b8db1ee83f7dd9f6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
113KB

MD5
d5c6b784f2561983a457322004c26537

SHA1
028fe5c6dcd690a48d286e592dd78a95d7eee0ed

SHA256
47b82a0c7a4a24e6541260482570ece2b65db282fdb3549ead7db1342cf76472

SHA512
bbb656a63e17af81cb1047bfbed3ee5796cbee9740b880651fb3fb0cd1fcb173248c2a08d702b27974e290d5990c49eb66935ecafa1ceee93dd53f25d4e512a7

Download Submit