4b601e139e2013a394ed72527a74ab391247938a30a1221f8d8b3d57d35f5194

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcf79b97ec6c86fc1839235867eebf60N.exe
Size

77KB
MD5

fcf79b97ec6c86fc1839235867eebf60
SHA1

d8160fc49f04d83703aa2a949566f98edf4e88e5
SHA256

4b601e139e2013a394ed72527a74ab391247938a30a1221f8d8b3d57d35f5194
SHA512

e3341412dd3b5ee755e8fde6f1d187db865bee6a7bbc86471cb633c63149953a9d4af6cea6cd591bae036a16f0bf74dc98b4e029d03f409051d33f16795394a5
SSDEEP

768:W7BlpDpARFbhYQkQzaxkd+axkdo176/hvYaJaMGw4PCs2B24PCs2BHE4JAIAepET:W7ZDpApYbVK4vx4PN54PN4OHepOHeZSL

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3246) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\VideoLAN\VLC\npvlc.dll.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\bin\jsdt.dll.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\calendars.properties.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST7MDT.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\bin\zip.dll.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.exe.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	fcf79b97ec6c86fc1839235867eebf60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcf79b97ec6c86fc1839235867eebf60N.exe

C:\Users\Admin\AppData\Local\Temp\fcf79b97ec6c86fc1839235867eebf60N.exe
"C:\Users\Admin\AppData\Local\Temp\fcf79b97ec6c86fc1839235867eebf60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
77KB

MD5
4caf0bf56c3062161b9eeaa67eef5762

SHA1
ba73a3e73124e5c093320a271e0de9004b2ec75a

SHA256
dd1001391f4fd9d28ee8fc849807750b0c9ae3112b1b38ae936600d4af50c672

SHA512
d5e54a53eee61103c2df96dcdf2a5b9187d4a5871c8774435345660dcfc025e71af841f7e939c166b271931105804a803afd62c5f8783c574061a1553a6bff1a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
86KB

MD5
af067cca4c045245aeeb9e2a56ea0300

SHA1
f85b5cd9bf0b8fffa40952baa3f9e9ba992b4f20

SHA256
42ee813c71e2b983594883248cf48fcdfea930821b3072baa0a9e01320ead210

SHA512
c3872a5522241deb73e873d81201b38aeade9b25c3fcfaad444df5b5f0281d24dc8131281866a8743179d2199f17e7adbf5ff424b70269849c8ae5c919159a8d

Download Submit