9653306173095c4faafe7ca706626de58dea42d61450348c91030e3c840cf7cc

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-09-2024 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75dfc039313560fd8ab54e83f69777b0N.exe
Size

58KB
MD5

75dfc039313560fd8ab54e83f69777b0
SHA1

4b23d4b03aca271c59d14cdf0494b6dd844b70e9
SHA256

9653306173095c4faafe7ca706626de58dea42d61450348c91030e3c840cf7cc
SHA512

9d4355a6ec00042bbb9c6eb09530ae696f9aa04b8acca994b43887e0250a986756a9e38163d7f9abef8a386078b9e46c5dc25bc61fb17c57f8894de8e92c8c26
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/p+:W7ZppApBULcfpHLcfpX2/Nw/NwmxD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3252) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Mozilla Firefox\application.ini.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\ja-JP\Solitaire.exe.mui.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp	75dfc039313560fd8ab54e83f69777b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp	75dfc039313560fd8ab54e83f69777b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75dfc039313560fd8ab54e83f69777b0N.exe

C:\Users\Admin\AppData\Local\Temp\75dfc039313560fd8ab54e83f69777b0N.exe
"C:\Users\Admin\AppData\Local\Temp\75dfc039313560fd8ab54e83f69777b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
59KB

MD5
b0007778835889a822df4232786092e8

SHA1
4dad704c032e524c934710f826a125b2b0f65c5f

SHA256
05abf852dfbee31ba8fb0b05011cf28794302beb763fe0a2cf2b079806ea6c3d

SHA512
4c51bc585934d532345c68229d8b7e8f477c402c6dc991087530091ea023232a86b74dc4cfdb8cebc313393ad6005f298591f662c44d9fd2c4fbe4d1f465fd22

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
68KB

MD5
108a9ebb813534ba6fcff0dcc3f77e58

SHA1
175e06dd8769473873c1cb743612317cbaf0194c

SHA256
b8aa0a1e8a050bacbb8b3b5c52690e1eedf7bc49dd75efaf914d7b29f3d06f83

SHA512
edf966a0afe0ea3a372f4429845093dab2cfa0efe7bce0341ca749bae28244879805cb4f40a8f5a52b6065aaccc5b4338d3717363c62e27bc2227be53004b2ec

Download Submit