e39c603fa1291d77c76ceda44ef1ce12db76d51bd9ef927fc780797d7dfc43bf

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73f6da396f58e409024d5cb1e555a4c0N.exe
Size

120KB
MD5

73f6da396f58e409024d5cb1e555a4c0
SHA1

e85b8600d1ec60336837d3df1a4a134c2b2f15a0
SHA256

e39c603fa1291d77c76ceda44ef1ce12db76d51bd9ef927fc780797d7dfc43bf
SHA512

d82c1b50406aa2c6bd1ec192b9a725478d6b18deee85920c8a492120ff104126db1136c3af9fd7fd185305b0ca53242ebca02ed5da16cf491dbfe9f0dbcb73b3
SSDEEP

1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlfS:6e7WpRaSljZS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2865) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jre7\bin\jpeg.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayman.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Phoenix.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\La_Paz.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\DVD Maker\Pipeline.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73f6da396f58e409024d5cb1e555a4c0N.exe

C:\Users\Admin\AppData\Local\Temp\73f6da396f58e409024d5cb1e555a4c0N.exe
"C:\Users\Admin\AppData\Local\Temp\73f6da396f58e409024d5cb1e555a4c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
120KB

MD5
5a2dfc5377b3e6adbd8f2ef9199a7a45

SHA1
39ef746fd8743dbcdd601d0e36753dd8a0fbb161

SHA256
5c174d1b4c76b3273db062e3858ce324fb8c127e1f9c75eac2e7a774671c7db3

SHA512
926e058c1f793614c226df1bfa9451033abe7b015ee8db6b65d8a75a839e58db0f6663f05c5bc79de45fc8c9c3ef7c0828939a5cfdb67852a403d13aec8f797c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
129KB

MD5
8b72092e4978f68d1c2a53d8e81512c9

SHA1
0b2c63e68c9a67587e8e33b95cae4ae848423ccb

SHA256
f5264084e3d9c295b291df1161d30b53d89bfa70ec7f4a163494b27dfe1cfcce

SHA512
f28e6e5c812f538b959515d9d8ec848fd09c4fed1ae8128b219767c61b5f1b589f7f8faebc018157fcef769e330835a80e801f51a7f00b44e75126cef00bb5a6

Download Submit