76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320ca

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
Size

112KB
MD5

1dd02b99279b5e9c8a82ff039c139ec0
SHA1

600823e34019871a2dfa68eedea4946b09fd4a72
SHA256

76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320ca
SHA512

3b091f31a8b910c0384bf9e14c06fb25b0bf1f862995fc1149f3bc4f4c54f5cb9227d6c2903b9824e0e0a3fae8459efeb315979f467de841de82fc720829b456
SSDEEP

1536:W7ZhA7pApH9QHwtRF9ESWu0SWutlggalggEpVp+ESIXosbosz1vKX/8KX/6:6e7WpHIyRF9ESWu0SWuDmmSIjX7

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2848) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Taipei.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6CDT.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Melbourne.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
File created	C:\Program Files\MergeRegister.reg.tmp	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe

C:\Users\Admin\AppData\Local\Temp\76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe
"C:\Users\Admin\AppData\Local\Temp\76c31ecf14a86af90017c6cd12cb4936a87abdd122f728eb4693f376d1d320caN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
112KB

MD5
9fbf73285b172f9c4f466f01eff4beb4

SHA1
5e898ae7d977ba299d835cdef1ee4b2d35e83a5c

SHA256
445db63ac27ab8eac931190da1c45033398fbc292af10dcfb36016d4a766108f

SHA512
655623e9c893a5659f585285850c841eb789c6789bfbd5157bb4d7579473c7ab4f72e971a83d76126f964b759d95d7ddc08e29f3d91855b19363d4a8fe000790

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
121KB

MD5
648fd5becaec43acdb839d3c71fa5a0e

SHA1
4f4e7e6efd47c4115780754a012b074c59f92418

SHA256
416a1a8f2ebb85d98f1226da5e7580d2015b783484f2a371fea19e5e78025d02

SHA512
0c13ec5b0f02462ece8fdb95e3f14f3eea3f7ab3a06fb9bd238a95ca891fefe3ce22b039ec2e33baab8231723cd6bf29792ad0cbb13a6c949d7248013d7c175c

Download Submit