249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647d

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
Size

51KB
MD5

7c3ed8255af73beffca8fc3e87296e10
SHA1

86a1b5d56b1ce33d02dcbbbe35c29d1f7e80e2ea
SHA256

249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647d
SHA512

f93773fdc5907e08a9a598494e15fbfc43569e41142ce5614981dd7ee50042f5c544b2b0035a765de6a882c64d13e9a72e4bf747ad4d2dec92851a37bc70321e
SSDEEP

768:W7BlphA7pARFbhL801VvM801Vvv7co49OiIJrbOiIJfo49OiIJrbOiIJsPIvPI0:W7ZhA7pApw03vR03vog0gY40

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3287) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yakutat.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\bin\pack200.exe.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Hermosillo.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\La_Paz.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Apia.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe

C:\Users\Admin\AppData\Local\Temp\249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe
"C:\Users\Admin\AppData\Local\Temp\249225e2627709a7198ac526626b3744c0ff5791c5e6f3db3fd93afa1c12647dN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
51KB

MD5
70445ca9bf765c393f43ceefbd22ac9b

SHA1
78cba65b82d69355aa34fe602224a69f50cefded

SHA256
99ec846b33130ff1433c8fc137a3fa4de0fd844a3e280075c38383814535e593

SHA512
46f08065cbf8ebc5fd79e16f1093c6b56512d692e3f3897185b413139878b2e364a13e3f7ca3cb100adac005b15c6ab38fdbed16ca75e4de8e299ebb2443bcaa

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
60KB

MD5
7542ab0a07ee0a3439994b5cbaadc66c

SHA1
97b49b8d5cf0c3316ca868d4ef3b8267e7ed9699

SHA256
86c687179f819f9e8c115045559cfbcbba5f547dbf3dbae52ca93e96b9fdc58d

SHA512
97bb74a61312843532883a045378a11e895585cf8bc9f6102dcc233bb228a210fa81409c90747e8a72c1ff8d8cfd08f82fb5174f8b2f05a3b7b7c3745b940980

Download Submit