0a1c2d24a1290ac27ae11d6fba89727dfacf2a456b48c5612f4fc545a851b894

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

560c34070501d9ddd8e95f96be9493c0N.exe
Size

78KB
MD5

560c34070501d9ddd8e95f96be9493c0
SHA1

b15cc4f39431d79669e2ee48f1f35b11c252b876
SHA256

0a1c2d24a1290ac27ae11d6fba89727dfacf2a456b48c5612f4fc545a851b894
SHA512

bf08e0cbcf83bb1fdfe51bd54b1427c3e42dacd0711e48a59711207bba265e164f7d2b0103899029e9fbb1c456beda1cc8721a40d5a4ca563e23db11224230d2
SSDEEP

1536:W7ZDpApYbVK4vx4PN54PN4OHepOHeZS02C:6DWp7Ws2C

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3137) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\DVD Maker\PipeTran.dll.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Mozilla Firefox\Accessible.tlb.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\.lastModified.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Adak.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_zh_CN.jar.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\jsse.jar.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp	560c34070501d9ddd8e95f96be9493c0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	560c34070501d9ddd8e95f96be9493c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	560c34070501d9ddd8e95f96be9493c0N.exe

C:\Users\Admin\AppData\Local\Temp\560c34070501d9ddd8e95f96be9493c0N.exe
"C:\Users\Admin\AppData\Local\Temp\560c34070501d9ddd8e95f96be9493c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
78KB

MD5
635a2013cbbeceb6f07e772f40d5c4c3

SHA1
74ca27b547510eee9601509328c29063f620d675

SHA256
3433558c05c8b5a2c17cf5a19ed42ec502a645fc79b689fbb67ca5fe8ef094c1

SHA512
82fc67ae05cff07cd5555a0b88d15bb1e588ae7e8f151404bea78964dce2caf1091ba9476e349c60fc20db12127fdda52544ae73fca5470c09a715c9a2a08327

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
87KB

MD5
24664f025ecb0c4065dbfafcad9783c5

SHA1
644e8ba906ff94d569828b65bf7e2bab600d89d8

SHA256
cc648d172c22fa97cc9eeacace31ffaeed8c58287060e50a8ea5e2b1a384d0f3

SHA512
6a0faedecf72108c768480add8afceb59d13ad213fbe80480b2380be5e18b5916c37944a45f57a783de6d5c77ba834b7680c19dec505b7dee5b2e88c105adea0

Download Submit