834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
Size

92KB
MD5

6b601806cf2b7f75d4c32446f8345f40
SHA1

96a2432d2c2e2c680985f6b1ed3b54a931d8cfce
SHA256

834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41
SHA512

e30fd540f99361428cda7b4b3137ea77874f7016c5d9fc40a81c97e149a0ea90fb9e6d8db2eed2a4b897264b70b2f3651d4e853573831d4312436d445c771fc4
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYgqe6:6e7WpMaxeb0CYJ97lEYNR73e+eGG1qe6

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2957) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Mozilla Firefox\precomplete.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Efate.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Microsoft Office\Office14\Custom.propdesc.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jre7\COPYRIGHT.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jre7\bin\installer.dll.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png.tmp	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe

C:\Users\Admin\AppData\Local\Temp\834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe
"C:\Users\Admin\AppData\Local\Temp\834f0c47f871a9b9483ddc17ec0904372842435b43164df9dec39e93ea635d41N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
92KB

MD5
c6ac4153a365f1e239be5b9632265506

SHA1
22bc3fecb917a8bd8e626d5a287d26c64c52d34b

SHA256
2cf8118f39f7395405b8e3c373500f639d1b1fd0c8a15baee8ea499c2bf0f8ae

SHA512
2f394ccdf2d789166d5714c9bfec250ee065e5bc65ed97d9ca04693f9f33f4f3368988d1466861e686e7395e8dbec35af9d994be7722cfa23fd7b4a7c351e255

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
101KB

MD5
54d901539e7377b942d84a07eb786e68

SHA1
555cd5bfe61c28761e859fe0a170ced7ac8bc661

SHA256
826f031fdaadd7040a33919ef4695d000ecc139731be25bd5ccf0a893c942e64

SHA512
2cf6f858f0ecc3e27d0117c2183fb451c3840498b75f820fcbf5f682e244b74b2b1e1419f6d1b8278bc57d38906e90178cb53f3621e146f765a808474da0073c

Download Submit