2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
Size

85KB
MD5

7b1ce1633585ee3712f23ef1dbc3ec40
SHA1

4768a196e6376e1181804f99ac753ffd4310ce50
SHA256

2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000
SHA512

9b4c9f143179956feaceee7c875bcee20f4ca4d589db7608aa72b8cadf100dbf7c854790bbb01c4043504cf2f114d5b82178ee0a08e33f6af94e50a1d636ace4
SSDEEP

1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGLtEraCuw:6e76mQSohsUsUKDtErJuw

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2901) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Engine.resources.dll.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jre7\bin\jawt.dll.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jre7\bin\jp2launcher.exe.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Internet Explorer\Timeline.dll.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jre7\bin\wsdetect.dll.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Microsoft Games\More Games\de-DE\MoreGames.dll.mui.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cancun.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe

C:\Users\Admin\AppData\Local\Temp\2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe
"C:\Users\Admin\AppData\Local\Temp\2254b2d1cacea57077e6f637b1ce5f12fe3a7779b56d2cd15c77341744433000N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
85KB

MD5
f16f94d7e145969affced45a3e7ac8bb

SHA1
b0aa7fc4d85ecf8f9154c031c95c5bc69417dac9

SHA256
ded7ae290186b1958a9fa186a10a81ccb9bf05fd678f6351171edbca41c96bb9

SHA512
262cb0f860ee58497cdacbfc812545ed1930e7866ea2ff6c12aa203fc631bb8b995d85290c8afe51bc5c77242b633d9c997d9451896c4f6807e7dcac52bd53fe

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
94KB

MD5
090b2ad2ed33bec7ec2fe0277366b678

SHA1
656c8a9f45eba38d71c7d38590815e16708c730b

SHA256
0b296d7ef6039b48a31e26dc842b47f9b652671b538ae7add0ed1991eedf08f8

SHA512
63455be1fe9f007adb6163b8486fa5cd13419b02c0a8029107b2322fa9bda5dc9035b316cfe435f13d58e71ad01d442250dab173a5f579731930e96c2433d3c3

Download Submit