6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
Size

198KB
MD5

88d703496c25e0613ea264a0479ae38c
SHA1

303f276cdd838a7fec9b4025827cf731ba8ad0be
SHA256

6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53
SHA512

dac6b3238fccf7fdb76e1253f34615bc4bfb3d99cc52ee8e041e6d324961e0e9583ae0646e2927c0311f58e1b8b0022c89fc42b10635dbe39e30f98485894aad
SSDEEP

3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBJTzkl:RqKB+tOkWKR0iJ0lTzkl

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3216) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\StopCompress.tiff.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.ini.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe

C:\Users\Admin\AppData\Local\Temp\6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe
"C:\Users\Admin\AppData\Local\Temp\6786f06c13c3b492514b326fae7439597d26926b18b65a1405e4987f1bdfea53.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
198KB

MD5
8e89124d524c821fb9323f0fa1c6673c

SHA1
6f29bfcbdef62370561aa2f80a1731982f4144e7

SHA256
b2904e5b5eac0c3a28fabe978b07441710de2d5b249e3487575ac3c37c65328f

SHA512
c806b3bb50633f570f35f5afc0ab225ec15e8d5d7537eb360ea2ffe635b36104dbba84cba3d2a6af21590d313640ea2761371ef3f1f2aba9d193f40c152352d4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
207KB

MD5
aa302e4e60ab9e76b2751c72ab6a6e59

SHA1
e0a2b075363befe6aee50f2cd11842a26bdfb3e2

SHA256
6f1224e983145e1d433df6f50de7deddd82984297461f7f27e8eddb295c2fa10

SHA512
9ad40d87245130ab9b983dcb8f7fc019e58d07bcc83717cbada8385171a0c19815c727f78bf22f8cc1885e6f3a613fe8e870944e76d7df1eba79136c97ac1ed7

Download Submit