9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bb

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
Size

109KB
MD5

1b90e32357e4ee996f7bfe5738c2de30
SHA1

a261b2c52b036609eccae9940532889bccb3edbd
SHA256

9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bb
SHA512

957e8c2d34241859c3dbf8db4ebc04ec18f4ea49ee9eb3af1ed868edea63d63f47847afcfc6a583583c99569ecb401231802458a977e0339c6bad327b008a7d9
SSDEEP

1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPIUpCUpiPZ:6DWpwE7oL2e+efZwZ08i8Q

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2911) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre7\bin\servertool.exe.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belize.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Selectors.Resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chicago.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre7\README.txt.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Dublin.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre7\lib\classlist.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
File created	C:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui.tmp	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe

C:\Users\Admin\AppData\Local\Temp\9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
"C:\Users\Admin\AppData\Local\Temp\9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
109KB

MD5
14f6dbae1ff48c630285b939604f2d3a

SHA1
d24e055f38abcbb0ebade3cfcd97df21ebcbf62e

SHA256
8c386dcd66541089539de7fee75218f81fda4f0544ec8f617c49bb1b3bb65d53

SHA512
5d971333328b25b21f16be9e5625d6116b547392206a397983126ccf69346e5c08447e087587754ced3267ef5889fa0726e8631f53736771a0ae74f67600844d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
118KB

MD5
e0d6e79ebd6793b50e93e7549c45a06d

SHA1
30fd53dd439bd60629666f1466ea72ccc2182a2e

SHA256
7064c4685a1d4d9b47f7e2649fbd7334ce5eba15d2bf6921e559177dc3d9c7e4

SHA512
45ba82f20fbae5a2da9511c977c35a3e470dc0829351b93c84388ee314668b032214a92d15d4684facae9517a116904fe297df52fb69f59d99414f85e58f18ce

Download Submit