576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadb

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
Size

38KB
MD5

8e09ff5618d042382ab1de8086ac2920
SHA1

5ea8c4bb01feca10b9e05bfed0ac4ede8a065b64
SHA256

576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadb
SHA512

999491a1f944a3bcbb488c95d77cfc680d1411e92c04ca40d4aa4fc7b6302549bbffa0f9776aa570e3f3ac943ee2325515925e8c68d423cd81e15b6729648d95
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltR:W7ZhA7pApM21LOA1LOl6AR

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4089) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPDMC.exe.mui.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\settings.css.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Adak.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\ResetLock.dib.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Windows Journal\it-IT\NBMapTIP.dll.mui.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\Chess.exe.mui.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\gadget.xml.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Windows Journal\es-ES\JNTFiltr.dll.mui.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe

C:\Users\Admin\AppData\Local\Temp\576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
"C:\Users\Admin\AppData\Local\Temp\576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
38KB

MD5
9940c1d835badb27b26d8fe7085b4de9

SHA1
4e738c4d23f6a4ac62e5428282ffe7ae1fad660f

SHA256
a0262c32dfca7d22c9be36e3a4c7f85ace9b2a4ab441dbcf063d4cf4ee861ed1

SHA512
6fbfd74837fc091c9a5b53260896413dbab167f9eeb7916ea56dd7797e3669bc0cb9092ed9dab20db01f636a8d86a216eeec21f94664fa336f0ce48a5edfcc19

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
47KB

MD5
a3de14651191a7fa596413142dfc4046

SHA1
87b6e760a48b2979be4d84afdc7d18b5cdf7b797

SHA256
aa21f0ef83858e534b30ee11955c58871347231cd46f9436b58b202de8400a8c

SHA512
96ca0afd50d883f23144bc6736f1d9028c85d4eddc6d526b443203711788fc1ffef8a0a2f25dffec70b0cf24f36893c2500e24309c9581cd91740317313401de

Download Submit