6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724d

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
Size

40KB
MD5

867bfbad84db0042fed890269ef279f0
SHA1

6abf0aa48123c5f6010d2d120745ab781eed93ea
SHA256

6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724d
SHA512

b4703bce5c810c137bb47687f0573ebcdd1a107817bba325275d10678134316f34b5bd4a3e94515cbd98aeae3d8eaf533dbfb057a825db55fc98dcfa8c9b0515
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSG:W7ZhA7pApM21LOA1LOl6vSG

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3456) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-actions.jar.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Sofia.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\InvokeCopy.dot.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Colombo.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe

C:\Users\Admin\AppData\Local\Temp\6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe
"C:\Users\Admin\AppData\Local\Temp\6d78521c08065bbd239a0b332690c6431c404198b3678cd25023004760ca724dN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
40KB

MD5
071c8db605e5f45229c96b37efd29ec7

SHA1
81ea8b451f3c549a91c74de9deb18042cb1e8d0a

SHA256
c6440fc74900eac6d6cbe45448edd5ef3fbe8175172554a46a30aa70f7c98fb1

SHA512
bffe05ce1dea691dce82c1fc4c25d053612c57f8e88fb7282cc75c7782706b8420c615ac697f0cb34b466c56169993e011d45d27809d7b7fd57d8224b51ef27f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
49KB

MD5
65eb21a2c5fb960b6268f7d36f66cacb

SHA1
8dca5d123b267da32e0e0cec220cb94ed1e76a8f

SHA256
c4bd74a455a704d1fe89ae8e6a0328dac6e2bef508c67c90eb50d7fc9eba6241

SHA512
19c64cd3a11b4f4aac7793469dad85536771b071a4efbe5e94130ee090a2b861008c610ee047073fe5cda98515b0ac537716c02d65beba08f3f468efdb21f312

Download Submit