60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
Size

46KB
MD5

f6b24d7a2eaa40f4e7f8b225ab76da10
SHA1

7b4149b13be9a6d1d05dc3571fbab40d54660271
SHA256

60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361
SHA512

97d8062550296c0d97daef72eec041ada14087b072a5f779a401f48f0d889e5b89a13ba8aaf6af9287fdcbe1ba680e6b5f5ec3f9217ed964c3d9196a369d1406
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FzzwzBnLLnLd7Mn3:/7BlpQpARFbhNIZPi

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3305) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Edmonton.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libstats_plugin.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jre7\bin\kcms.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe

C:\Users\Admin\AppData\Local\Temp\60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe
"C:\Users\Admin\AppData\Local\Temp\60a65e2c75e6f6c0b908fa4a5cb82d9847a6c6b9565c9bf59aa27e258e3e0361N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
46KB

MD5
f3ff2884b358dbefd90d9075d5cf80aa

SHA1
407ea61686d0fb6c0b84e2abe7a4c8b94fc1f70d

SHA256
338ed80ce9ca884734745dd0b2e130112f645a65eccf1fb35892ef6c5df88c9c

SHA512
d805538fc39022be83755654852cc0e1d7ea997389cd4bdafbe691611f9d9e2ad5cf603428e24c60e769784e98aafd44c313d68b0f5d93566e55bcf665731fe9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
55KB

MD5
f3f4602267f8b572299ca2acae25a6c3

SHA1
f7f049708f9b5a7bbdd7b93267a2ebae19e50f84

SHA256
70aeb38e102675e7cfe52d345d2583e91234e68fc5a8048fd5d324f5e5e5cb83

SHA512
be8fea7b4826fb1a09acb247a78ea7f01b63b58fdecb7c4d1dbb4041b92014dba758dec41d779a4f5d6b12cef77b027e47125e03166c2dd70cdbd6e93c0fcfde

Download Submit
memory/2280-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2280-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download