728c5cdb2f7fe50a9ac19d98f7562f8e8e98218ca4d66422d39f6c434afcf709

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90f4d12f95c8f635ab1079712502f160N.exe
Size

80KB
MD5

90f4d12f95c8f635ab1079712502f160
SHA1

119792998bbd6636855b9e57021ddf7779f04130
SHA256

728c5cdb2f7fe50a9ac19d98f7562f8e8e98218ca4d66422d39f6c434afcf709
SHA512

696028ff3e3681934c0afeb900816d301fd4a691bcd5b025b78c41c0a629446842d3927a225110f15f40041244b1a57a90de197036777599516eed107837cebd
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7YNNdNpyI8yIRpC4Cm:6e7WpMaxeb0CYJ97lEYNR7kzlSnC4Cm

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3037) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre7\bin\java.exe.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Colombo.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\London.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\ChkrRes.dll.mui.tmp	90f4d12f95c8f635ab1079712502f160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	90f4d12f95c8f635ab1079712502f160N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90f4d12f95c8f635ab1079712502f160N.exe

C:\Users\Admin\AppData\Local\Temp\90f4d12f95c8f635ab1079712502f160N.exe
"C:\Users\Admin\AppData\Local\Temp\90f4d12f95c8f635ab1079712502f160N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
80KB

MD5
2da63aa042145c5095e29ffb883ff6b9

SHA1
2a48068a56f78834d7eb3ab199a5eee015c4223d

SHA256
5fc104d787c2b8a5a2c135e11889e5e312572755e50fd00c0f95c70c26c08e08

SHA512
e4aa50a94b8f33d4968f56bb5a09bc372eeda3edcff1d8c49c5ef4110d626447f9568b959eb40f8946ed0275657a0c14367e78a0b87c7a9f75e713170978bfbf

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
89KB

MD5
dda55b745c11da169a0a72206072b1a1

SHA1
214025cd96bfb94ac6d84f365c6d56f76a2c3d96

SHA256
adf952bccd5e46e908788cb74f703937fd467fdc4565b109cc59652ed7d54e0b

SHA512
6b7b84d5bb820c02e3d8668892949445ea06b220c7b9e9085dcc85bef96b45fd077d9173d4bbf43871dc4e06daeaa8c64c0dc378b7c44592796a814eefc15d53

Download Submit