392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0f

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
Size

40KB
MD5

6aa9bcc221358ba3a3f24c6ef42ad7a0
SHA1

4773b174b45846a92ef012256b042b1e3849d146
SHA256

392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0f
SHA512

dcf4bcb3cecb8b68aaf0cbb9d50481456d384135bed21cb467cf4459c948d1462c4cb04cb3c829795c3ed51cf65e4816aae9a16438f0c23f9f00bcdca8523c44
SSDEEP

384:yBs7Br5xjL8AgA71FbhvsKvbT4/Pbf89taJrcT4/Pbf89taJrK7V:/7BlpQpARFbhVvbM2MI

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3259) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jre7\lib\management\snmp.acl.template.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Internet Explorer\pdm.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Iqaluit.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wake.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe

C:\Users\Admin\AppData\Local\Temp\392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
"C:\Users\Admin\AppData\Local\Temp\392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
40KB

MD5
17539579de13fc430b999f772306479c

SHA1
ff80cfc40eb56f39737a82ee3b81d1c357cb30ea

SHA256
c3ab061ec04b882550e34630740f848c4b7725288f5f4c8946a3b885ded9a263

SHA512
9ef9790025087f6d26b76009aba7bb76146a5d2e363f23905297cde5148fa220a96dadba862ba37109fc78ebc5f28c01149a7271163f8fd8f397635119015510

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
49KB

MD5
ee20b7efa2875d15c712d3c799e7d35d

SHA1
9efeb5d0767c45119843c1dff57cc98f73cf0f94

SHA256
9abae56f37c60d4c331bb8f944796c2d8502704a640534d2e7ee63dd06afc4d1

SHA512
314e2afa850a3b4a72c30988025fca8a2d8552c59e42ae9a2c527eaa95828a3c389b82131786feff29bbf4edc6a336577f602159ee3c9372370697642541dbf6

Download Submit
memory/1984-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1984-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download