b664cd1074a4f1644900f80341c6bb579bc0f90b8e01bbab06233e7bd2b27199

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c99f332e8e23c0ab0dc2189921acb30N.exe
Size

63KB
MD5

9c99f332e8e23c0ab0dc2189921acb30
SHA1

a3d8755d83c06ba2dc06d7012b7aed8c4d08c9f0
SHA256

b664cd1074a4f1644900f80341c6bb579bc0f90b8e01bbab06233e7bd2b27199
SHA512

ea9cc70a3ce6771e4de6b7b6401448e7c4b9151916f18028b4b320763f7d34a27b4996803805f63a2f940bf26253df617f3f909a04837c5215b2eee296d2c637
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw70EXBwzEXBwcJdkCKPuJdkCKPS:W7ZppApAJdkCKPuJdkCKPS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2899) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\.lastModified.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guyana.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jre7\bin\orbd.exe.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsFormsIntegration.resources.dll.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-options.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Berlin.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Engine.resources.dll.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jre7\lib\jsse.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\VideoLAN\VLC\AUTHORS.txt.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp	9c99f332e8e23c0ab0dc2189921acb30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c99f332e8e23c0ab0dc2189921acb30N.exe

C:\Users\Admin\AppData\Local\Temp\9c99f332e8e23c0ab0dc2189921acb30N.exe
"C:\Users\Admin\AppData\Local\Temp\9c99f332e8e23c0ab0dc2189921acb30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
64KB

MD5
6289406adf867a86c3ca079871530fec

SHA1
006223d7c9d1fd5f1fdbd8882bd59fcff75d08bd

SHA256
96d703f8b2a881e2f74f618dfc730d304ec2cb6be4306e5c6daa52814905b7a2

SHA512
0b132d223bcf287350efb9886ad9c165db6f4af07064e51c7f1706a9abe50b2ed986b8a078d193fff5b83df4b93bcd40a4afc3deb2b47786a25cf7c8498e9658

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
73KB

MD5
4305f9c39b55cfe9e951aff705bc5719

SHA1
e91de8aa693946c959c80ec762627eeac5341826

SHA256
c787f1ec20c066ad472ecf4ca700b186d2d4bea9d2d06a5a5d962f16f1b000f3

SHA512
850debb28981828be45db4adc1d1c6b1e271b8ad29491608df06a7a9888a3d9b4160052744d97d116644d08b6a3287f2f2bfa0bcf12a2393d9560fc7d43b19a9

Download Submit