f81638efb31c8fb54afe7320df67683a5f31942cc7f75e56abda46e9697cad2e

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

299251bc9442da32799c3c9fb9d3d770N.exe
Size

57KB
MD5

299251bc9442da32799c3c9fb9d3d770
SHA1

f127dbc04f881960c1e5a697b61c1128333e3e78
SHA256

f81638efb31c8fb54afe7320df67683a5f31942cc7f75e56abda46e9697cad2e
SHA512

1a4f4c4e437497f5c0ef92af659443d18e69023e628ffb04da156522b6f55fd74a83d8d746dcaa8d18c09e290e5a282755b7d787b39e6f05485720e727b91f6e
SSDEEP

768:W7BlpppARFbhFAxC7ntkntV/1HOCi1x6HOCi1xwXN:W7ZppApryTeue6

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3368) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libmpg123_plugin.dll.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jre7\bin\unpack200.exe.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jre7\bin\net.dll.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Samarkand.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.ini.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Apia.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	299251bc9442da32799c3c9fb9d3d770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	299251bc9442da32799c3c9fb9d3d770N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	299251bc9442da32799c3c9fb9d3d770N.exe

C:\Users\Admin\AppData\Local\Temp\299251bc9442da32799c3c9fb9d3d770N.exe
"C:\Users\Admin\AppData\Local\Temp\299251bc9442da32799c3c9fb9d3d770N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
57KB

MD5
a9cff89a7dfef44d30b9364ab791647d

SHA1
8c3b3645eb543483c698a9c27bf01cf33929b10f

SHA256
a7a7002e93c999aa8d0ab8d10f7e874d0b9d52e2b1df8d183537cde0aa3b0a0b

SHA512
a7594ec5b2c6875f96ce6ccafa737c1109679c6f97fde230c9f847417e9a999bb0b03763b3e3f0cb7b87d8f28d08f64cb353b23743da98bb0ab13e6d12724acb

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
66KB

MD5
101913d7b5cf729cecc1571c6fb4e437

SHA1
80dfe5f39382868091ca63bf6ec665feb0f0ad9e

SHA256
1daaba5aaed4452b92d7746a2542ab136647815f4ec6fbfc6cf27cd27c427c1b

SHA512
4cb41fc1793cbb59b5abd97cafa61717aa091602ebea03ae9c327503d519f356763cff620307ee059dc8be820038538b84111628de376bdf2692d5e9c0ccce33

Download Submit