74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
Size

107KB
MD5

365e3d9f0c621de7b5bf024286849b0f
SHA1

30d6ef0a78ff6c1b96a9c7eeb0438bf454be74e3
SHA256

74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58
SHA512

efa1dc277161f5ca182b284f68fb8d4d0110483b7e76d152c8ff95a019a81ce09bb676690c60fb42c972e12efa9e479bb0fe2ecdc5403d4b3b1823374817df96
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBt:PqFF2Ie+efsim22

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3434) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.png.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmp.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Windows Journal\fr-FR\jnwmon.dll.mui.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Adak.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Windows Journal\jnwppr.dll.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Windows Journal\Templates\Shorthand.jtp.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libmft_plugin.dll.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Windows Journal\de-DE\NBMapTIP.dll.mui.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe

C:\Users\Admin\AppData\Local\Temp\74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe
"C:\Users\Admin\AppData\Local\Temp\74783a84d9e92e0f09dea80a1843f6a1b12f130b0f3641f2b47dc0e8b8d82c58.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
107KB

MD5
dc7fde387b97509fc58e1c7b038c0db6

SHA1
e56d27f18c941df62e6cde493276cc0d57bd7cca

SHA256
e76d36d47a92795faaf1567f6c912169cbedd11edada8f9fcbaf0b51e6fc1800

SHA512
f563145827ea051e7572f4269c522f9b99eab0fe0c2ab606a643ea71ac2468c1ea33596668e13d13c69f969bac85910c3e1f9b38e1b7aae4e39fd4e7fe0f5bc7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
116KB

MD5
2caa9dcb2a4d1d62ac284b71a3408fd5

SHA1
06e1ce086e1233e3533e590609f726b963d71b17

SHA256
722023d202f8d4c4d7393d2535198c8d6e64c0b2cb2f783689739941ad6d5139

SHA512
ffaa35f794cc257e6ec33b92d410431559898ddbd9ba48779425165390a656c2bcaaa3c760e0a5b5f5036812caa877df8c5960337452a0387476f73bf43b5019

Download Submit