312aeb6d2e836a6bdbb4a9bdad1b31691e8dc5516aad98b36d4d3f14c5711b85

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4662244910ed9ea2b13cb1a907c444b0N.exe
Size

48KB
MD5

4662244910ed9ea2b13cb1a907c444b0
SHA1

393c2d5ed6ef905226974384be33da056ed469ba
SHA256

312aeb6d2e836a6bdbb4a9bdad1b31691e8dc5516aad98b36d4d3f14c5711b85
SHA512

87ba46c1ad1c81aa172a5878c7830a2fb68a602863cc3010ac5bb010e670d86e31aaea8064acef96ed6d103d467f6ac5652be9608d40f84390f22f5488bb34e7
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltIIRIy7Blp:W7ZhA7pApM21LOA1LOl6Ad7Z

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3243) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jre7\bin\zip.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Mozilla Firefox\platform.ini.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\DVD Maker\PipeTran.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Regina.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp	4662244910ed9ea2b13cb1a907c444b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4662244910ed9ea2b13cb1a907c444b0N.exe

C:\Users\Admin\AppData\Local\Temp\4662244910ed9ea2b13cb1a907c444b0N.exe
"C:\Users\Admin\AppData\Local\Temp\4662244910ed9ea2b13cb1a907c444b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
49KB

MD5
04a6312bc63b8d8a60517791d5c83e6a

SHA1
bb0ff503e410b5285ec4f6239465523dd60542b2

SHA256
c91ea030ea2aba10892cfa1d907e9063e027939281a85d57e43013d0e0f32482

SHA512
c7f688c7b9450113706a64a51818659fea934cd5feaeadebd9fa61323b2bb3f5bbf51fb5b95d4d6ab216ca82f36ed72996566e9a7fe91b5bfef086aa678c1748

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
795b8c4b30bdc3cf79d4ca9ccabf02f2

SHA1
446fb93652fa32d05eabe248052bff43f3590e75

SHA256
d803bf1fab53de70c8c67a697ccd319bf497e519c3eb9675a99b89e1e5b8b973

SHA512
59b9ab1e77a1b9c0b72c9df510d912becea6eaee028ab8aa4865270c903234459d65d153457d9160818d063708f64daf6d33424fa55dc0be9b5613ccda39d23c

Download Submit