773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
Size

87KB
MD5

7aff243559e540b58e5cc841767b3c00
SHA1

26a9026d0fec708780a121af2545f19e5e30ebb5
SHA256

773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128
SHA512

e1bfc628e698c048fdbdbc3f9705c7209bf2edc90ba4e0a1a92b4931cca99dcd63318f5d1d393cb563218c42cb3c10bc6699f37b43347ae34820c0f12f426bb3
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYrc4:6e7WpMaxeb0CYJ97lEYNR73e+eGG8

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3098) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\updater.exe.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santiago.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Internet Explorer\iedvtool.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-progress.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Mozilla Firefox\precomplete.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Games\Chess\fr-FR\Chess.exe.mui.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe

C:\Users\Admin\AppData\Local\Temp\773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
"C:\Users\Admin\AppData\Local\Temp\773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
87KB

MD5
9395d7ba53ea8df187f687d3de1874db

SHA1
643b29c679c0f1c80c3d816ea05da2132499d6af

SHA256
82738de73b57973494fe3270cd8909fd8f5ebb09870cb9704db5b9b7df2acefd

SHA512
84ca948ff5991e58011d94cf428abd12c653e7813585cd4edbbd84453a0dd34c39d38fd1857fcfc4dd41455172e82ca47f128c4ba085d6f6918b95eda235b74a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
96KB

MD5
11b631a441d4760a1cc3982bd0844c2d

SHA1
98d3b28b10f24c8c50346ac34d116832175d3b15

SHA256
e2ed772d1aa4e7f4adf02a7a7fec8d963ca579c311fb2022904da61e70e0f9e9

SHA512
6f19c576ea5e84f54384913f694bef801725531aedc08981e2c2b88d73a9cf1b6d64175301de83550e9849e2bda5e8be7f419b8273b1949634354d7a24ff400b

Download Submit