78a2dbd752f0632e4f036e8d42b907b5738c561f602428b1eebea2813a48809e

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

59f9b9423fde2e4d0562aadee4f8b9d0N.exe
Size

55KB
MD5

59f9b9423fde2e4d0562aadee4f8b9d0
SHA1

2398aac23cace50963702e5ec83f0dfac4902e4f
SHA256

78a2dbd752f0632e4f036e8d42b907b5738c561f602428b1eebea2813a48809e
SHA512

cba0ca833b404d828b033eddc6e3fd9a5f11f1a75b5721de285f0e6bb4e776804c44cda95f144e593ee2d2fd967b351996881435098d40aad33515fb35e80e31
SSDEEP

768:/7BlpQpARFbh1WK9WKsE2BdMLBdMWN1J3DCl4N1J3DClF:/7ZQpApQKIKsEDkr

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3206) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jre7\Welcome.html.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgRes.dll.mui.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Monterrey.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClient.resources.dll.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk.tmp	59f9b9423fde2e4d0562aadee4f8b9d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59f9b9423fde2e4d0562aadee4f8b9d0N.exe

C:\Users\Admin\AppData\Local\Temp\59f9b9423fde2e4d0562aadee4f8b9d0N.exe
"C:\Users\Admin\AppData\Local\Temp\59f9b9423fde2e4d0562aadee4f8b9d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
56KB

MD5
bd81518340b9bd78f2fb817b02c04b60

SHA1
f708731de0d4a993da3885c82ffec7255eaea578

SHA256
82520f3d5b72cb79580c65df1d52c47a5d32c29a48cac927234c145304cdd841

SHA512
c66335415c3b8859093890074b3945ce3528b40b96ca4fa2849a49d6f65e12ec22ef947f4dd1fdee4ac58de61c4ebd1e4062e14daa9651e3c802dee13c4f0ca0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
65KB

MD5
84430effb381cfb21d98399a206ac388

SHA1
a372401c887599d7fbd9535f60b4be751f13f4a7

SHA256
7203a41a01bff3b8edc2e858e224fca8cbd78e5381d3c6bf83ffdf86924ba9d6

SHA512
29770a70efa7e058229210b9f18d26c7f0c2adf2f348cd0569e923cebdc10f346203e4307d2bc522cc9161b0bb3db68a5b09d79e75a04d637282fa72d6149be1

Download Submit
memory/1728-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1728-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download