9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eaf

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
Size

47KB
MD5

9544f6036ae67f2fd5fae3a5bd7c0390
SHA1

90b8d53510b4208504874f8974fd63b5df5d6f70
SHA256

9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eaf
SHA512

7cd7b082edb0efa7a940f5b1feda9925ea4fdaf16c06deb8fec19935089cba0653dd9f5067e40ac01b8d8842be9ceb1487873561fbbc668c1f417c8be2571c0f
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLBbfCDTbfCDU:W7ZppApBULcfpHLcfpyDkbfGTbfGU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3455) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Regina.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guyana.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Windows Defender\en-US\MpAsDesc.dll.mui.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\VideoLAN\VLC\libvlc.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
File created	C:\Program Files\Java\jre7\lib\zi\EET.tmp	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe

C:\Users\Admin\AppData\Local\Temp\9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe
"C:\Users\Admin\AppData\Local\Temp\9b6574f64dc2698cc560668dc1055511af9482946c3aaa0758f13a6e62ab8eafN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
48KB

MD5
0d477c9063aea0f724d7b53fd459c209

SHA1
0d71f3eee1942e3d58fab2f4716d129a8c29ce61

SHA256
9033315c8b36b27132b10097cf24419e1ceaee8c7458ed37e68d5eca903e34bc

SHA512
cbdff9d05d564dacbc01179445382bd30ade89cabdb7dcdeefc8fa5acbfcc2e747bb7c58c663e8e0d84a1bae602cb7cfcc80c5b138f3ecf8b1ac6b54d9bcb413

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
99334e2f35b45ebdd692495e2f29d0c2

SHA1
f2df45be1aa4476ffeb28a41067eec6660a92448

SHA256
e9c2a43f250042477ebd8c4f82d1de230cc6079522a97eafc19e369127e300e7

SHA512
bb9083157feaee0362cf437a267f72940cee9141bc8773e6c6a4f5bad4c7868ebabe39f15f4d15edaa152098121a898125b920685786c04ccbc9618afc3c096c

Download Submit