24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 19:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
Size

169KB
MD5

0bf0dc5cc56e511eb17b57727ade797b
SHA1

399edd9663bbc71877fcd644a42fcb5f976e4cad
SHA256

24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19
SHA512

0e3b16be59e27e54d5a3d46036a1e4088d93fdc0741319e3a5014aafcb537e833f9508dd52b7f7481e5936454792fa724ce12a0bc3ff6dafc0f63524c6fa367d
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFMEhLfyBtR:PqFh2Ie+eyEuFF25e+eFL

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3438) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\ChkrRes.dll.mui.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\PublishRequest.lock.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\lib\deploy\splash.gif.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\bin\eula.dll.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\DenyDismount.odt.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\net.properties.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsFormsIntegration.resources.dll.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
File created	C:\Program Files\Java\jre7\README.txt.tmp	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe

C:\Users\Admin\AppData\Local\Temp\24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe
"C:\Users\Admin\AppData\Local\Temp\24753251e130fb6ea48e9921bf8698b985c9754981bb3d1e992ac917b3557a19.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
169KB

MD5
cde2d735b3c2456416caef166d3e4fb7

SHA1
4ef0f0bfd8b0da9b051350c7ad1c7ce2011f7293

SHA256
0a605bccb9c32658d0de72f8ba9226035f0d507f5c4fdd58872c066ad062233a

SHA512
95a8e29203c3aafec96e9ea5b2473627f2cb4e331d89b9fd5ff5a7693ccf1c0828942a83c6ecf4618814d1942f3963fe211b5422db1677638eab164eda8f137d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
178KB

MD5
ee9ff797c02ddfc045847220048438c4

SHA1
92a887c67ed9e362dea3664c746c080dc1cf448a

SHA256
9ab604b0ba93a1950346a57c474dc18de39bcf260010a53c678b13a918c08e7e

SHA512
dbc01064ce4697cd37644cd4a00787b331bf864198883c9700f63d613ccc0199ead74653a8a0d5d2c50e8ff4097924f5643a82bc49dea5a3528d50824c8f3ea5

Download Submit