2285a5c256c0bb1d29606fabafa379a06bc8f5c8dfecabc2de1799b9612a6fc8

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

87a5b0d532a034c400e701650032e5b0N.exe
Size

87KB
MD5

87a5b0d532a034c400e701650032e5b0
SHA1

948b4c52856fc8405c17ac0e5ff9db47b8dda6c2
SHA256

2285a5c256c0bb1d29606fabafa379a06bc8f5c8dfecabc2de1799b9612a6fc8
SHA512

065d66679418259a43871d7a0e755c3aa52638993a4394ee1543bca903666594a758f56b5d050c6518e4f467a1a6ab40ab747c7de2750735b2606cdc145aaa48
SSDEEP

768:/7BlpQpARFbhiWb8naOnaBGNS10w2Yw23:/7ZQpAp/Eaiax1l

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3089) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\chkrzm.exe.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\splash.gif.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Internet Explorer\Timeline_is.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\ReachFramework.resources.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgzm.exe.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guayaquil.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87a5b0d532a034c400e701650032e5b0N.exe

C:\Users\Admin\AppData\Local\Temp\87a5b0d532a034c400e701650032e5b0N.exe
"C:\Users\Admin\AppData\Local\Temp\87a5b0d532a034c400e701650032e5b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
88KB

MD5
a90ec782afd4d4eadb25a69391898a55

SHA1
d51819a29a41b9e0db9554dae67d4e5106025e17

SHA256
d4a4b29ea1c36363923ec2397218f2e89ba5b3d631c25dead68858648bcca4f2

SHA512
766ec5b30e531013596c9230885dc162964861fa701815338d4ce18dbaec171f04f716658992a1a05cfc10e88c4a0ed13978bb31d87eff6f89333f5a9007ca95

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
96KB

MD5
ff52a5f285f140d9ecc4a6228552c602

SHA1
1b85a660796fe3c0fa9a7b49344cc4766a0a252f

SHA256
445428c779a4f01fe669cd510555341ad1c68aed0ef09ef3f3c0e0348b206a98

SHA512
9f73fa17ef10d6121cf2aa5e5b9d483b0710dcc6d2360a386969b7f23384f7eae4fe6d4c03bb628183c80cd2f5c09e21892532c8fad83a2821567f95b1ea08d0

Download Submit
memory/2512-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2512-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download