92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
Size

89KB
MD5

e7770076f30c93d7b599dc2b795b7590
SHA1

0f0d05ab2056c569c0f2fef8e8dc203b31861601
SHA256

92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0a
SHA512

cc4095581cf1a6e1fe13c99a291930de67523d213ce9dc40b607ab56b8ca0d0b841f284b1cfd68c11268c3300aad831ffa2f2b1bea2250a533eaad26a8a1585c
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhO:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsb

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3088) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\VideoLAN\VLC\AUTHORS.txt.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jre7\lib\deploy\splash.gif.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rainy_River.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Mahe.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jre7\bin\rmid.exe.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\CET.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe

C:\Users\Admin\AppData\Local\Temp\92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe
"C:\Users\Admin\AppData\Local\Temp\92b2be2558024e1c81b6cd8cf16242d00684ef922da12e4cc569075a2e221b0aN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
89KB

MD5
fed8d49739d0f3094dd93ffa64640fa1

SHA1
b45b97f76f4437c380f016707e754fb5f4ece9d7

SHA256
8fd212d70052ad52bcdf1da29eed4e7ee3ec32645d475c2a5742a335e2a90ec6

SHA512
e0bb4561d007d4ee73c5063231298fac7291cf9bdc0bd660ad36001af31b670cf18d72098a6d21e95632704aea7e5cdb15ac76291b339a813a15efb3cf9b9859

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
98KB

MD5
547547d482ab4e913d49edf277015f7d

SHA1
4bc2545b7804c8f9ec1592477824410c261f1e76

SHA256
3130787389bb3c2a227c7496ca265bf8dd6408c6aeaae01d2f7a37890a2bc9b5

SHA512
bdf02ec17da0d9fc79ebde66e20a403920cc9d9fd8a23f9ddee5fa1eda771b982b2d7ed27110d4c8b7d48fe35790ff1ae7a92845c99e0e05c18b085f47abc71f

Download Submit