937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
Size

50KB
MD5

e0f0f7c903d12ffa939897831968c210
SHA1

685b75701c363f1f7d75cae99ac0c0dd1e3639b8
SHA256

937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750
SHA512

f57f46af4a19130fe5789b501ed2155161898f287ae37e61cef0f7660794dca438f466902931a1a09152294ad6004733a6882c6eaab0f878414852843019e834
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLkEbTa0TaK:W7ZppApBULcfpHLcfpyDeTXTb

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3276) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jre7\bin\glass.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\DebugTest.html.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe

C:\Users\Admin\AppData\Local\Temp\937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
"C:\Users\Admin\AppData\Local\Temp\937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
50KB

MD5
acc65c55a5ad00d4aa3323f234b0465d

SHA1
e653fa5ea22267762d145a761a4fea9e504e202b

SHA256
3bfda778bd7bb3e44d83fee5a0801ca5c5afd3980f36546e2fa32fb824d4d7e9

SHA512
bab3a5e14dc52cd230b5fdf111ac1de345ccf407086d782e0e8ee02e7d1eabddc97025e9cc513918675c97326ee0adbe2ea9e20e51b344d2ad72d80cc1117dff

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
0b48a37ccc129d223c666e4d7ef9eced

SHA1
dd5dfe37d7384af444d400be91b87bb6e4594247

SHA256
d715109cbd1a22a098f94a7dc131354ef0c89bd704ea560ad9caf53ad6c266c1

SHA512
2b141f236c9d0c983dfdcfe88fcb131d0b03be19888738f7758b6af8e362ec4abe27a7a955984f6ae14d066802297cc8199371e87bc388b85fb2e1c4cb2cf49c

Download Submit