6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
Size

44KB
MD5

d3417e51fc1799afb4224b4518aa2870
SHA1

98ee6f68ab942e06801458e134988beaa430763e
SHA256

6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676
SHA512

686fcb5e6a3700795b9407c92ff112d023229bfeb7c1d08fb69c9e182932b0ca7fe443e8a73fd20114dcf5dfb55a8e7e5952a3276435075a247e1410de4a3f2d
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpdj+KtaXi1xGtaXi1x6:W7ZppApBULcfpHLcfpBfSfu

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3336) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\St_Johns.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.tmp	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe

C:\Users\Admin\AppData\Local\Temp\6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe
"C:\Users\Admin\AppData\Local\Temp\6be107ddaa42de8c191ee9cba0b352fed6e690ede2b6cc5a003af1a132add676N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
45KB

MD5
a9f11ab88efe8884e92f6e6172e86802

SHA1
20ca957e4b798ca76446d462c422bdf06d6b2a9f

SHA256
2cce8828e8ad5d8ef0cf5c39d42661d61069388fd58e058b8028c4ef172a5e78

SHA512
5b749219efe51eab2b2a5d0011ab82cdeeb850f31d261395cb481d34949ce183a99ed5c6003890ae594e406ef73e219b814a6d1e568f3fb1a8a4d92b7392c75a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
567169e24a64bdbc0cb3b4bdf24f6219

SHA1
09d576b5d4efa3dbc70ef23964bdac6d8d7974a6

SHA256
57497b109eeaab1bc2f4ec5f709b35a2608b4a56257aa3f921236a68626ff7c4

SHA512
5cc30d0aea5e4572ede22d574c6361c859c3458b7fff579fc6ab85eabaddbb124fabf4d951684727bc82093bc89899e8351745e2e9495d8b4480369efbe6bd65

Download Submit