915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
Size

47KB
MD5

7df9cb950eb855f0329d9dd1be9a9c70
SHA1

7c4a6514d7d03f4a7a01003169c0e1b72a3354eb
SHA256

915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193
SHA512

593faa3e99da960c2643178bfd95cc3c799df52a5678e67f8450bfdb9e1b1237a1d13890bb6ee32c68071bc1fbca6e25527e3c4879d438c67a0bb45738d81285
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FYzyKbNzzyKbNUjZ2S8W8Hoz:/7BlpQpARFbhCWK9WKKj38W8Hoz

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Araguaina.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
File created	C:\Program Files\Java\jre7\lib\meta-index.tmp	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe

C:\Users\Admin\AppData\Local\Temp\915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe
"C:\Users\Admin\AppData\Local\Temp\915143c5bf7711efcdb5ec4108a7f00b09f191a7c6becd6153a0aae954e3a193N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
47KB

MD5
344f6d813ad6de3a2e64812145c771db

SHA1
8a36e76c8f1efa75bf4705505d7b434b777f97b0

SHA256
f2622d01c46642388b964c1085308e11064c3ebc129c56985e7206ff3b79626c

SHA512
c5003f24eaeced4e2fe6aa2251c036e24b5103ff86d232e7d6866230eef8a9c6fb889dd7944a46fbaf754b33f2ed4c3c5c09d9fe410169f851493a619650ad12

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
791de2a4742d507717273fb33ff39b74

SHA1
ef697959687c6523cfaceb00fb629fe3e858060d

SHA256
0340353c538218f8bf7d14c4890a30e5fd81b0c66aaca8c07c98aa67bd7b5641

SHA512
58d31b8edd6dac539da3c300751a1b48cb5a05097a71cfa8584963c374213cc65e1ce4b29c2d5cd46ce05ad190983c9143895452a1d3c5ae92a53bd9a63e8268

Download Submit
memory/2748-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download