402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175ac

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
Size

113KB
MD5

e3a06958f9cd796a342ae779e6070c50
SHA1

43e500f718188fffcd33725a51e2270a564d7f07
SHA256

402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175ac
SHA512

db0e332de29640f3480cde8392770ad4c8c6765ba2feeaf61fa0195270051be97987744e1bedcc9218f5226d883303d22d550df3a30df7efa06bfa9da0c2a6a8
SSDEEP

1536:W7ZhA7pApH9QHwtRF9ESWu0SWutlggalggEpVp+ESIXosbosz1vKX/8KX/B:6e7WpHIyRF9ESWu0SWuDmmSIjXM

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2840) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jre7\bin\zip.dll.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Mozilla Firefox\nssckbi.dll.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\DVD Maker\Eurosti.TTF.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jre7\bin\JdbcOdbc.dll.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jre7\lib\charsets.jar.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ust-Nera.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jre7\bin\ssvagent.exe.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jre7\bin\unpack.dll.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe

C:\Users\Admin\AppData\Local\Temp\402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe
"C:\Users\Admin\AppData\Local\Temp\402fcb56b9cd0dc4c1ac3ecfb03cd30295bc7a53a25778fab1d0d94bc57175acN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
114KB

MD5
ddc7fa80a5c12facfcc8989a22679330

SHA1
6884a71a95ac75492f9acbeb213b671f14d0cea6

SHA256
54574adcd92be7d4e48e76d22bd73668cef63965b8c675edeae5f926767ad51a

SHA512
727405adc8756958e8991ea3b99098825ea7e8a668960a5367cefcf1ea0c5de3503666784ed79b9d05f90a3c882194d97b4ae362ea2373c08ec564a1756e1383

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
122KB

MD5
551beed5df85451ef8a128f1194cb1b9

SHA1
50e71cc6685c568f5b8e8f5c54e4175821777c43

SHA256
48a04222fed04048df5e282f471d920614055316b5c11c991fca688cf0ad8117

SHA512
0c151551c4ef5bc83fd944c7310f7ad74998019b747f4c9171313822052c25fe42a1cf6dcbfff6e3f48b92574a79c7bf34708f523cb6656c83735e1b8f61c3ce

Download Submit