86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
Size

45KB
MD5

976710d976a44df9e5133ffb90317683
SHA1

501451de784ecf2064799a2e648c4b609b7e0bcf
SHA256

86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001
SHA512

bff2eed745d7c8e403eed872df90122c1c2155c2b0ec46b011c50f33dbd736897b85b6324371ad5fe68bb1d0daa2285a559a404b987882435ca59528144be8a3
SSDEEP

768:W7Blp+pARFbhBgnKLMWK9WKD2N2LSarSaV:W7Z+pAp2nKLRKIKqoLSarSaV

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3736) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\DVD Maker\sonicsptransform.ax.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Mozilla Firefox\dependentlibs.list.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Windows Defender\MpRTP.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Windows Sidebar\fr-FR\sbdrop.dll.mui.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\clock.js.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jre7\bin\eula.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Windows Sidebar\settings.ini.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-desk.png.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guayaquil.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_m.png.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties.tmp	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe

C:\Users\Admin\AppData\Local\Temp\86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe
"C:\Users\Admin\AppData\Local\Temp\86b635ab9a4d1a03528fb8b0a790fc109329a4dca683de71b141e4cdc75cf001.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
45KB

MD5
79a2256052c4654101cf5cb6034c96ad

SHA1
50266b385e572068f3be6ef7e1ff08981f7c3bb2

SHA256
91cf1e7de6ffe845526b8b445fd1457333734d61c2a4b3a3bd442b54ddc2cdf9

SHA512
bc09919227b11b57a712f519c8d7a2c767c7cf644d3402b3603095f3ba2b165609614378d64e0ebe91db829a632ea99c297735d3013f1db94a922d03d5936aef

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
4609c0537b942ef7d3a5688d72a52e42

SHA1
46187b137d55d5460ba17f73cf0773ed8b0a4c46

SHA256
7a4c0d55ee4214a59afd7d796e5267780ef921d1ac0b1edb6849dd4e878d47f7

SHA512
a93469ffc2658f786ef21ed48a3bc9be7255003450c9429797ec46234faa1d45941698a4bfb2db51e0e7804128df4332e49a735e518b7dfe5e51f7f3287041e5

Download Submit