699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
Size

84KB
MD5

7c4573588253ae4c603da5cb799eece0
SHA1

1f6021d4ce39a095fc486f2adfa9c087427bd7ea
SHA256

699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309
SHA512

da6b7c81006d52049c789488ae8f6921894d5cdd83202a8e0c551e38882f5523188ed12177422d66f38e87658fc2ed1aa6510d7e45ece31452e95edcedd2c47a
SSDEEP

1536:W7Z+pApfGQ3y3RWvfmRfm9sKsSd55tDYTYigE:6+WpDfmRfmhJts8igE

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3157) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jre7\bin\sunec.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jre7\bin\nio.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Microsoft Games\Hearts\it-IT\Hearts.exe.mui.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\SwitchRestore.mpv2.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Brunei.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
File created	C:\Program Files\ResumeConvertTo.M2T.tmp	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe

C:\Users\Admin\AppData\Local\Temp\699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe
"C:\Users\Admin\AppData\Local\Temp\699700c95aa602c76686c87cc6df23d6b5dc882683694c86031f9220be0f3309N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
85KB

MD5
1f15d8cbbae43d24da5be127c7d4a7e3

SHA1
62912e87362ab4a323dd9f12c03b7c123975d09a

SHA256
f554568fd887b65b967d472314688a95804febcde3c6a3da54d5f178f369bba6

SHA512
c3e81d93895cf6aba9adc80253a029d57c2f3e0b7ec345a91115779f803116a7e8469ef45bfc7516cb4f5e5db20c000891c02eb7bc7b0fcfd5d1a400f2152b70

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
93KB

MD5
526d6b4c61f9f3000ff15dd8c9a63784

SHA1
6532a6601f3acf883044c2a1b57e3abdc860d63d

SHA256
69f08cbbfe616307528b66da1040746ddecee0f58fad985905dd49ef631b23bc

SHA512
9f6d6c751ec655d2ebf8450d7cbe22134199510003ac85e2ab2711199a1c7ed9db8ab7b93a5dcca4c92db4eccdcae4fe4bfdd49f8afc3d0571859c75ef025c8a

Download Submit