7a1e1f6665584fa247f5253df4f666b109c7b44e50d775920d18336442ff650e

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f35f01a16826dd75881e9e616790a50N.exe
Size

80KB
MD5

9f35f01a16826dd75881e9e616790a50
SHA1

ed815360e15e836f3aa0492f13622a916fa7e647
SHA256

7a1e1f6665584fa247f5253df4f666b109c7b44e50d775920d18336442ff650e
SHA512

506f86027ad9e2ee002edca0107294376b6a7d1a32d17e114cb05e9495e63c658a1c620ac8ae996389445bed3a1083c13c2c134a589ace3e3ee68444043f7810
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZv9pkAHA0:6NLWpCZIzjwHwLL

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3157) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\New_York.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Microsoft Games\More Games\de-DE\MoreGames.dll.mui.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Internet Explorer\jsdbgui.dll.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Mozilla Firefox\updater.ini.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jre7\lib\management\management.properties.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-ui.jar.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santo_Domingo.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgzm.exe.mui.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.tmp	9f35f01a16826dd75881e9e616790a50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	9f35f01a16826dd75881e9e616790a50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f35f01a16826dd75881e9e616790a50N.exe

C:\Users\Admin\AppData\Local\Temp\9f35f01a16826dd75881e9e616790a50N.exe
"C:\Users\Admin\AppData\Local\Temp\9f35f01a16826dd75881e9e616790a50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
81KB

MD5
18a66cbb78d42c62cfead6177f0b4414

SHA1
0112ea016373b47949ac0562c4f6ee1f190a05ab

SHA256
b66da3c6302cb5e0b8c203b73277581314788f0cdfddc198dabe45db32d82c51

SHA512
8b2c8d526e19ee1932daa3c881916918ab9138969c7b893e575dfdf04a3ceacdfad33fca2816d8aedd67f57747080de6e8c73e61a9223e7b31f9d342c61a4b82

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
90KB

MD5
8c26911c5b42e975ff8ad34aab07ddaa

SHA1
1f8bdf4c9012e9215d18d0c7e22360db94e23831

SHA256
f2c4269a26c3a6c9c0f6f29a9dd4a37a89596cfd07c596008a56c252290b44aa

SHA512
c98f62b92e42c15aaf509e81f240d533ebec6d47ab0a02dace04e732d727b84e0a9ff5e47fa1fcd6cc22a241a618724bb61440b24ccbb2864283a3fbaffcdf26

Download Submit