2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8a

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
Size

121KB
MD5

c9e17d2abf593a1c706bffda8d155580
SHA1

90f3f4da18c579e403412c4e8a4119687b8a7ba9
SHA256

2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8a
SHA512

4f46e8278077bc007275cac7577fc451bf5c5e08000c36be01716cf25e4b6599362ff2d5b2d93497e61dbe54f1e371e0f8972e60824bd09f40925785ec81e61c
SSDEEP

3072:6e76BtEkoIAkeF0RNyreZ8PRmqIZq9awE0ctUiQF2vUHFe+0AkyyDfEmU0RFWh:Re/EUQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2837) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Almaty.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jre7\bin\jsdt.dll.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jre7\lib\accessibility.properties.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll.tmp	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe

C:\Users\Admin\AppData\Local\Temp\2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe
"C:\Users\Admin\AppData\Local\Temp\2c4b718b7d124f177a0695ef025a1fe2db87c7516b8efb5b7eb48854f2189f8aN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
121KB

MD5
3f834faf55fbff6536d62133d6a8a394

SHA1
dbdd335438bcb2fb0ca3c5fddfdbd1161e3e6624

SHA256
7b55d678329a980c1ad4a07c64f5f0d59fd5e04b6f6e5828a334d3674542e6d3

SHA512
57166b816f78e47412456c13648f13910d5cad9e1540f510ebf7d4aeb2bf2d3627afbd78831aa56ba6938a2f84c87ea823c5db4a1eb0eb82fafe1ec7271e43b1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
130KB

MD5
c86e58d3f73c1cb5b910dee389933105

SHA1
74836e2f8a39977c3211f3a9b441dee04db70ba2

SHA256
c8b351d1ac267f3ce6fa940d20bb17ae1516c33ab67e31d17b4592be1908a8f6

SHA512
300a4c0fca4670baf858365bd6c837b3c3433e6d098a05641e5835fc7d88bafa148329d4c523af28f17a912ed03fec4d08dffe51d718db779716e03f0ccf3bc5

Download Submit