cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
Size

50KB
MD5

9851b29df8ca435e450091810d8af080
SHA1

19c9dc93e5957853e7d6c46d9a7c2987e6aec43d
SHA256

cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675
SHA512

b583d2705c13645b195c6aa6788cfa7124633a60a3561da9c96eca57367e5c42d87204d43bcdce83da62a3e283d325f1389a1c05111356a5f56f9d63733c76d6
SSDEEP

768:W7BlphA7dASbSjJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c57eI:W7ZhA7dABJJZENTBWv361

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3081) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jre7\bin\awt.dll.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jre7\bin\servertool.exe.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Mozilla Firefox\mozglue.dll.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\InvokeLock.m4a.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.common_2.10.1.v20140901-1043.jar.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Almaty.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe

C:\Users\Admin\AppData\Local\Temp\cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe
"C:\Users\Admin\AppData\Local\Temp\cec769e5169d8af53b7347f00a35116a07502be43ad8f695154f09ecaa078675N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
50KB

MD5
d31ef33b867296ff662399e958e66fee

SHA1
9be4b03e8803029f17d235d3f0153c96b6c7dd8c

SHA256
7aba828202faeed59e882277e3d1c0acce5a55fa76194d584b0d86b10cd22630

SHA512
431ad8483ff5202022dbe7b605ea77b17f6ba943cd352f2fec84e330888428f3c6f41232c336837ed586f88e3fd5e7c43f07d6f0f5c46a2422a423e516e56b64

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.exe

Filesize
59KB

MD5
3462cc8a3653ed0e41887c20295d0010

SHA1
923ea9589fedc3b46ee77ff31b16549118f4e309

SHA256
c8827475f1f093a84f3ff3af40450005f405ebafd7951fb6bc00dcbdc531ac93

SHA512
132449bb0ab686095e382f3aa93c443f102c8ff376f168ef2cb7c8d7e45b6180ca2907fc58c2843a42a29450da052f3579941b9e20fe567cea9125188f5c2203

Download Submit