06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
Size

32KB
MD5

e7f1b05e8b0e7a834946a10640d582e0
SHA1

4eae5a5bd9ee18a427927b52d65f737d3b084ae3
SHA256

06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117
SHA512

68cd803bbf5c0b5cb1730306244f4637225df31bf8bdc29dcc5b81e325d7fa88d5a51c8938c5eb755706edea92b26feb7240c05967394a6611773fafe777fa40
SSDEEP

192:tACUADIY0Br5xjL/ScAgAQmP1oynLb22vtPeGyvyq1iGyvyqkErB7rBYRvLdvLWE:GBt7Br5xjLfAgA71FbhvtPcIxk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3358) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre7\lib\jfxrt.jar.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\AddInvoke.mov.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Palau.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre7\lib\management-agent.jar.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre7\bin\jp2ssv.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe

C:\Users\Admin\AppData\Local\Temp\06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe
"C:\Users\Admin\AppData\Local\Temp\06fd4084f85935216b821bf9eb235210971585619482f578121ee8c7b1bc9117N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
33KB

MD5
8915a333b8c9faa4efbcce2b50c4d07e

SHA1
03f223f9ebbaae2a714269b687d7239da56738a7

SHA256
1e075c8957629d0c3e24450c63b0e6a0fc25c75e622ce33741a46d14f0258b57

SHA512
0de8e33c3469d8c805e939d17fa7586c34098c7cdfdc1522b346b1ba34e9d4e9a92095d4a08edc5b73cf757745838b2282b9de812d7e99d175465c95dc11f33f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
41KB

MD5
5200dada9128a4c0e83a5c02063b87ad

SHA1
2a769209f2471edf1b1e5269d91c941202950305

SHA256
2e3d6123b29f9a12a05d57385961eb5bfe012523ae9e23954d2a2d75bb820fb1

SHA512
86b2e740969f7ec5c374062deff8527ad8be81ad479a211ad1505a5c309668b72da13ec4dbf86932c2565d644bb80feb2aa24fa06762782955c12402f19eeaa2

Download Submit