9f1835e0e357e4faaea5a7ac9ea95fa758572195fbd94d8bd9a6581efd299d0f

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c09af7f15a1529b824c20b469885570N.exe
Size

146KB
MD5

6c09af7f15a1529b824c20b469885570
SHA1

67a64f07d5159bc0a378778c896e525df7da1794
SHA256

9f1835e0e357e4faaea5a7ac9ea95fa758572195fbd94d8bd9a6581efd299d0f
SHA512

b6309fde66cd75948116ff3869b7ad91cdff67afee48b35917d2f8f8691899434d234b2d2f0534a98894c758b56fd10e7d8ee24684a79455ca98a364f60e651f
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7f/e7WpMaxeb0CYfcd:RqKvb0CYJ973e+eKZOf7fWqKvb0CYfcd

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2811) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-options.jar.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\content-types.properties.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\bin\jsound.dll.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Mozilla Firefox\install.log.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.ini.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\zi\CST6CDT.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp	6c09af7f15a1529b824c20b469885570N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	6c09af7f15a1529b824c20b469885570N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c09af7f15a1529b824c20b469885570N.exe

C:\Users\Admin\AppData\Local\Temp\6c09af7f15a1529b824c20b469885570N.exe
"C:\Users\Admin\AppData\Local\Temp\6c09af7f15a1529b824c20b469885570N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
146KB

MD5
97d7ee6bd74a7b3bfbb2cd6aa6da457d

SHA1
d9c5362e4ed611b0c1cb6c7dd1ba22bebfbf73cf

SHA256
2cee6c1d37230d022e09a81206ad6d8e9daf617f1c0711cb2262277d1f4cf4d8

SHA512
2f16ef93a8ca2954fdea337c7b98e223936d30833304a6fc5fbd3eb8fff698c3bbf18fea54531e92907a3cbf4cc7a13aa0f6077a49351822e66099be46e42e32

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
155KB

MD5
5e1d2192ffe5940a52cf8b8b7743bd5e

SHA1
47f8507db2ef14af4763bdbf55acd1ef1068311b

SHA256
714a5525fcd24caf1748d332288e5409bdece006e03e702abdc98eeea509dd4a

SHA512
9218377388fdcc51aab3820d1a7a296829e7b2f242310f405066b4ec339c4073c25c27c3ea9724c707438f109a8e760d3f2ca6194e70f24f7e7c5554c70a687b

Download Submit