86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8c

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
Size

72KB
MD5

c8a52664b07d21cdcd5352687ef7a2d0
SHA1

2c2efe1c17b741af97ca7964e38fc64229ed58de
SHA256

86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8c
SHA512

b0d6b8628e96117c6de2b1d8087141cb7241c330322459e86daf55ae12884904cb85e8d85c2c9c44d3e2563d9273234c5be3bd22e12a1f023218a6c8b5c41ba0
SSDEEP

1536:W7ZppApwEwnmJARJAaXxXNJdkCKPuJdkCKP3g+Xq:6pWpUnDXxXYgJ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3168) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\orb.idl.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Internet Explorer\iedvtool.dll.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jre7\bin\policytool.exe.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe

C:\Users\Admin\AppData\Local\Temp\86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe
"C:\Users\Admin\AppData\Local\Temp\86775160586b6bb847e71cbd90443ea7eae19431a90eddf4470230b839d77f8cN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
72KB

MD5
762d2ece28926b5e826bcf1f912be703

SHA1
ad01ef3a59ed7ffd91bc3084b79623bd0db9d4c4

SHA256
3fc44b421fa5e5e19652d5fc57e00cfce6cc3349f6a07901a0e77fc55b4a5ef2

SHA512
f73874186c41a9924b48bb9029928beded4f3e899b3cbd43eaadaff7b20dfd5f8f6e7081e8ef6b6430c776376fcaf83c66120d23c824ae7d8644a9058af7c6f3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
81KB

MD5
df11eb9596aad2475fa20b91568040dc

SHA1
fd12a2244307bf74f5eb6a17547f6d709f28df0f

SHA256
7e1971a6d18750860a8f0e861efd26dfc3649a74d2119b30f0a9f945f3fb703c

SHA512
8232b6838694e522308c6a07165ee9205773a0430183ed4503dd76a2f2a742f7a60a531e6b4cf1631d35062cc9e4c0ff76a161a7c06d8c49badd46268a81a973

Download Submit