294fe473f48608a9c56d99e4130eaf7b6b32108a204cc67e2b39b917a5f5583d

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d468d199baae77f9da6f81728cba100N.exe
Size

56KB
MD5

6d468d199baae77f9da6f81728cba100
SHA1

bb75ffce52d413f1e1ec3261a6323e5a19732f0a
SHA256

294fe473f48608a9c56d99e4130eaf7b6b32108a204cc67e2b39b917a5f5583d
SHA512

56c6120f1f0efcf4904f1d040681c6de259214b549c5bf8394c7b4d37cc07d9cb91c8957147277215a98fdefad55c11e9ebf087017f5c934692162d2a729bb13
SSDEEP

768:W7Blp2sspARFbh5YSfff9n1oXKCqzEIn1oXKCqzE1IwScIwSWF/MF/z:W7Z2sspAp5YSfffMrfr927

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3368) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jre7\bin\orbd.exe.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Martinique.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libmosaic_plugin.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunec.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.RunTime.Serialization.Resources.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_asf_plugin.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp	6d468d199baae77f9da6f81728cba100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	6d468d199baae77f9da6f81728cba100N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d468d199baae77f9da6f81728cba100N.exe

C:\Users\Admin\AppData\Local\Temp\6d468d199baae77f9da6f81728cba100N.exe
"C:\Users\Admin\AppData\Local\Temp\6d468d199baae77f9da6f81728cba100N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
56KB

MD5
1875ebcf2a6098f9e6918d1c4c06c528

SHA1
56c649517b7364b6e26b308a304e4ddc69708a9a

SHA256
7f577169fa92a148c39e03307b851d9394d2047da41fe18f9e8082800fbde0aa

SHA512
4e98b090b55f940226f4c79360121447e79a6d842c9bdda743a41d95ffc2c58fa6459cfe72b0ccfb39d3f9251843c5b17a75e85bdd36a026c0234758c1d82f29

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
65KB

MD5
a94b9e520f1c8ad8a3bd5d9c16068ee3

SHA1
67c6113ecb51cb4fb0234f402cf8fa4cea7a2054

SHA256
4338a79c3b68bd3b770ec1403ba3eb81094b0a0bf8800affb4234f8a9a69f586

SHA512
07044145cd3b9b8713c652a73a8cf2a73c673aa879b887a0e295857d5c39ad064c0782672d9ecc1bff6dcdab57c4fb318d51b75ddef17f3e3816e40713722649

Download Submit