9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1e

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
Size

49KB
MD5

8af4940cd9d69cc83f12b00fb832db50
SHA1

cb97aff324a7d325580732df432c8682bf380d19
SHA256

9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1e
SHA512

7f9c08ab477459963e63d3d51171eeebc90bc922fa77bd4cdf0c8e5067cc1ce33616b5759a32fa51bd1128c6c069b27a00c898583e64ee98f425a61b38bba428
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLBbfCDTbfCD1d6e:W7ZppApBULcfpHLcfpyDkbfGTbfG1H

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3252) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\VideoLAN\VLC\NEWS.txt.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.RunTime.Serialization.Resources.dll.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jre7\bin\t2k.dll.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe

C:\Users\Admin\AppData\Local\Temp\9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe
"C:\Users\Admin\AppData\Local\Temp\9966c063152ff064bf908f915d9d6f1082aef25be2870e5cc52e1666a6420c1eN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
49KB

MD5
c17c84829c5d714ce020eff6ae0917a0

SHA1
fcdc0060d9dcdc6eaf35fac5402b07aaae1f4740

SHA256
287341c6f3b6ae1b54b10ed70ba078f596636574664e0e041a94b35cde71e435

SHA512
8f5733e0d420b133e3fd40d9be073cf0261285bbd4f674bcd40efe8f1e843278fa36c7f0d4942355024f5873bad1e87a885859bc8226ec15cc99fb4a3a4d580e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
770f9b0fd7ab230cc8f2482d9ed410dd

SHA1
82e12c2014bf2f56489ec830ada0cbea00dde1e9

SHA256
73579483a3c643c9ec772636fcb9e532d36e1b86ba23556a6376d295a3b0d07d

SHA512
627d67597391a0584614f20c7da415709a480e6793bca9c77b739d5a83e6d3801f7637544229704bce3ad1c2ebfe914cee208fb834d2051a4d415c322a591576

Download Submit