94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3f

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
Size

43KB
MD5

7ab8edf805c021a283508d5061fe4ba0
SHA1

ac267ef8eb3c8d40d0a303ecdcdc6778c33a8d7e
SHA256

94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3f
SHA512

878685dacd7a1506b12a862718b97bbb238cc484f5dfb835a64348fdbc6e3b15d7752f166f9fe87e0795cb431485bcc87f5ad1dcda4139cb1d972128d2431e7e
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFZPsFhiXFhiKJKGJKF:W7ZppApBULcfpHLcfpyDZPQqDJKGJKF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3276) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Mozilla Firefox\libGLESv2.dll.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boise.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Regina.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Windows.Presentation.resources.dll.tmp	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe

C:\Users\Admin\AppData\Local\Temp\94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe
"C:\Users\Admin\AppData\Local\Temp\94a71825c6916bbde6d24e50a024f29f23b1a125302c2add3c231470dae8af3fN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
44KB

MD5
7775217dd0a69484e6f01a2a0e4bfb9f

SHA1
2101a4946b21f5e74fdcfcda8865fc942c0a0faf

SHA256
d38df7eb747cef124cd4a4301d52c660074047dcc928c01bce136154a2d3039f

SHA512
d12c9615358f7393fde12a93a8924cbb30d8da8fe0346ad92a03d07baf1c00726c80e2d856c1f848e1f6901f7b212109ec64c764ee356041d4b2bf29f28a4668

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
7f280c2e04715f0c7083e0c1b6c47dd6

SHA1
30ec9adabf9ff163f7f676a6b3a6db34eafea2ce

SHA256
bdc1e7ac24a403177ada69e78bcae46667e4c8220df99ec46e042948ee4ad979

SHA512
2ed274c85e7f4bd265a165513bb36eda54bc6c2dda695899d11499465490dc73a56c29535c4065c013f5be0f387364bde994a82ce582f638b9c180493c2a147e

Download Submit