907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b

Analysis

max time kernel
149s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
Size

49KB
MD5

5d10e27b7a48c3fc916143edb72d2c13
SHA1

38553181c662695eb387c5434eb1ebfdc21bbb3c
SHA256

907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b
SHA512

75d6529d9d58f62399031c14c7b4fb56f42c7757b5ae85befaa4007322974bf447de889cc356cb5f5bef73994de57c09bb2909e176fbe23b1c7db7b0536a5642
SSDEEP

768:/7BlpQpARFbhfyiyooa0OMiJfoa0OMiJ2kAHAvmdGwmdGD:/7ZQpApHz8kAHAvmdGwmdGD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3789) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Mozilla Firefox\freebl3.dll.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_over.png.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\.lastModified.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\cpu.html.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\rtscom.dll.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Windows Media Player\es-ES\WMPSideShowGadget.exe.mui.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Mozilla Firefox\precomplete.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\MTEXTRA.TTF.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\mip.exe.mui.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\settings.css.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Jamaica.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\ReadStart.doc.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\ConvertBackup.rm.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll.tmp	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe

C:\Users\Admin\AppData\Local\Temp\907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe
"C:\Users\Admin\AppData\Local\Temp\907435b8529108a6cbb061374e7021fbc6ad4c3bb7aa49c186643f995105cc9b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
50KB

MD5
65599a2099232c147ebeb86cc0e9c144

SHA1
8892f74de08cc3e849cb1b4a55a14f234568feac

SHA256
62d780ad66106b039a7e61ce3aa06ce17db5c5e3ccd9569df7983199672d5c79

SHA512
452fea3c24b0d4bc5025d32e28bd0d1c13051215cef5e2a00235d9a932320112cb1bb6a74125eeb2773c4b298917e231db54be7fd00cbc64a88b11a2193199ac

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
919160ef7685f92b386b64e92405359f

SHA1
3bb3935e1f94b9bc0e3f1588829fd558e4495172

SHA256
c268106cdfaba0f5f27bdba4433c706d7a2c16b212c28f9ee23333544b970cda

SHA512
02e2433cfd8d7e105a78df474413017da3f54b60d3c7a62c650ebb49086d48b2a9017b9ce2b6b0a97e5938a2c5e421cc9e36883d2dc48b1b45132fc3dcb281b4

Download Submit
memory/2380-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2380-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download