a864999ecb033da011c7027c216f2485b82748d693940f344ad2e1736bdbb826

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 21:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b030a7859a3f1cda2faa8ecdc673e420N.exe
Size

72KB
MD5

b030a7859a3f1cda2faa8ecdc673e420
SHA1

3c315c42ed26a35d31e9442d4035997343402ffa
SHA256

a864999ecb033da011c7027c216f2485b82748d693940f344ad2e1736bdbb826
SHA512

1047094844418cd7283248cdeac0e0ec78861baf8386b4d860f8d92a2647df16c2e6ac614877b0f6a68c8cacb1fc16cf5418792f3eaed9c87ee211c7b7029275
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZvUK2:6NLWpCZIzjwHwY

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2834) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST7MDT.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsFormsIntegration.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClient.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b030a7859a3f1cda2faa8ecdc673e420N.exe

C:\Users\Admin\AppData\Local\Temp\b030a7859a3f1cda2faa8ecdc673e420N.exe
"C:\Users\Admin\AppData\Local\Temp\b030a7859a3f1cda2faa8ecdc673e420N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
72KB

MD5
2d123b4875d199f93024c0c84f6f302c

SHA1
a5b4e550ac1d6eb4380d4c5635de8e5ac375c91f

SHA256
e1b0124d929913f70d8d2557ea0a1fc5790da127fb2a8f7182850a38029451be

SHA512
f18b29341008b8466e38f3a27879ba6943ccfdba691e264d24d4404d74b1c1056943ab61bbd647fe9554dce0d368b9f53522620313b58aa6c89c216d14aa8fe8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
81KB

MD5
effe81fd483ac93a4b83005cefec704f

SHA1
d67d99c103e36ee391c6ace9bf83c46d6cdbc79f

SHA256
1d0d69ee3d2348c6ec5ff554fcdebcbec211002236d37bee3c7bfd658bf351c3

SHA512
b809077dcfa8d0321d2f12db53013ac95e2526f94f09ecad7379cf2607e7946b520170abb118cb51d33bdb1222938fbc0220493fdd3533fbfc10908a7c3879fc

Download Submit