4f82d90392a36873c80424a48be918e621de1f1d24584a038e715a64e1ec3500

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

847dc35ab78c23e2c197446d1fcbc780N.exe
Size

87KB
MD5

847dc35ab78c23e2c197446d1fcbc780
SHA1

dc4b3f056b2e23b5d1d819feab0e8f01b6e0c6a5
SHA256

4f82d90392a36873c80424a48be918e621de1f1d24584a038e715a64e1ec3500
SHA512

80c88a607d1a2603c419728a650521ef470a2566c207983392d90e746139020517839efc8e683c0071921c85ee798f478b79f45c878029560e87c0fecceceb45
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdTJilJiqTpTr5y:6e7WpMaxeb0CYJ97lEYNR73e+enxM

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2935) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\VideoLAN\VLC\libvlc.dll.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jre7\bin\hprof.dll.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Louisville.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsdt.dll.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Catamarca.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Microsoft Office\Office14\Custom.propdesc.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jre7\bin\glass.dll.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	847dc35ab78c23e2c197446d1fcbc780N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	847dc35ab78c23e2c197446d1fcbc780N.exe

C:\Users\Admin\AppData\Local\Temp\847dc35ab78c23e2c197446d1fcbc780N.exe
"C:\Users\Admin\AppData\Local\Temp\847dc35ab78c23e2c197446d1fcbc780N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
88KB

MD5
5cc6894c82377f9757a85cc78ee3db81

SHA1
2ec36d5dcdd9d893714830d3f85539a1f4cf1e3c

SHA256
cbce830aa71eaa9a908bbd17f6831566b274d6c03afde2f42a6d6a0dabfb1434

SHA512
3f77bf21084fc8c4ea4b2ec977e12bf90bd29ea0f9cfd19f8dff6eb972325c961614e5f7e4838898b86ce7a3888acb02bb8f576261fd8645043d6b1bf325b9de

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
96KB

MD5
42c9758ec69b936a6a5ce11aefb6a26c

SHA1
b4e97ab51341271f4d6e5db1edc4a9624144299a

SHA256
78df383f3e11b3d42c01e2c55238e9f42963939fca85e65142c69e57db7d0c52

SHA512
2197bb1e255954d20ac36ce5d62cd6986f413fc7fa43b8d61c233fb52f49c23fb24aefa246232f8661fafd76a1c944ca6509a1f6c4de1da161ca02990842e554

Download Submit