69092c0466ed40f8ccff9ae94b0a0c39b63e09c449d201cccb0fa291705d57e1

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efeaea6771f90d6ec8094f41ca9f1890N.exe
Size

253KB
MD5

efeaea6771f90d6ec8094f41ca9f1890
SHA1

42e67413e08ad2cbd5e17b49bc43afc59e256ed1
SHA256

69092c0466ed40f8ccff9ae94b0a0c39b63e09c449d201cccb0fa291705d57e1
SHA512

badf967a069735c99f2d51d0e5e0fb370477914e1fd7513370a1539b34dc3322c69433ebf929ea3bfd8d30ab9e09d1bb43c7a0d40139d552b26ec53693b7108a
SSDEEP

1536:W7ZhA7pApDOsZKZZSjw4Vc0Vcyu4PN54PNz3NIw3NI5:6e7WpDkDSzTzFWS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2319) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Internet Explorer\iedvtool.dll.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guatemala.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Regina.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Internet Explorer\jsdbgui.dll.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jre7\bin\fontmanager.dll.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jre7\bin\jawt.dll.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	efeaea6771f90d6ec8094f41ca9f1890N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	efeaea6771f90d6ec8094f41ca9f1890N.exe

C:\Users\Admin\AppData\Local\Temp\efeaea6771f90d6ec8094f41ca9f1890N.exe
"C:\Users\Admin\AppData\Local\Temp\efeaea6771f90d6ec8094f41ca9f1890N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
254KB

MD5
6eeae17f58ad80f71bb6b05ccf866031

SHA1
d444e4072db63d97290c2b048e8020188d414a53

SHA256
575bf1c1bf20d94e93daa9ace3e429b2501eea35c7891b01e931025c7c3c9a14

SHA512
602082024c757ab25c88cd322a54d4deaca39481206f266788b3dd525d9fb7c9c05f0c51c6ecf7f467487f42a00588e37f2963f9029777aaadc2273026b8c909

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
263KB

MD5
3dbdd8679dc37c8a0d7777fa9359a986

SHA1
e71e7cb0d794b629d6cad1426d4cc4eb56fef028

SHA256
fd90d5f7cabecc26667a9899d09806e3f3ef6586ac04cada0541a9234f6f4beb

SHA512
2a8c167caf911b25bdb486e289d955c17480e073062e5d1cb46db4684800e396f5a0a04ef5c61a955f83463c4138d758b689e5eeaa20573d30a048211a5a09fd

Download Submit