0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
Size

36KB
MD5

e7adc8c3c881a5b494fbc8c250b2c5e0
SHA1

8f91532adcc6e72b20a1cb45e57789ca92e1222b
SHA256

0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7
SHA512

bf18640a0e7b8c8ea8a89a152e13abe9a7af94e00bcec49b42987ce218573e95d0964e83ae8451558aca781ec7eaae6b5f320267d49d4fff9b5ac655384fc24e
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHdGeqc4SUqUGeqc4SU8:yBs7Br5xjL8AgA71Fbhva4S04SH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3252) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgRes.dll.mui.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jre7\lib\security\java.security.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util-lookup.jar.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jre7\bin\ssvagent.exe.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.tmp	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe

C:\Users\Admin\AppData\Local\Temp\0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe
"C:\Users\Admin\AppData\Local\Temp\0824da157df0c93ff874eec69e19402e1c72fc8e9fba0c78d6381d016ef61ec7.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2660163958-4080398480-1122754539-1000\desktop.ini.tmp

Filesize
36KB

MD5
6248605db0e813ceab56176744817a1e

SHA1
98030872b4d6121768e5e02d20431ff2e0d17725

SHA256
c72277d9ef3d4d3343ddcfe25f27b485321ddc1a35c51c9edde2874c5ddf7eba

SHA512
c50b773514d7c0270505d86357fae8f5bc013a4cba4cc086a23c0eaf68edfb328f3a62589fb9effe1bcd3069cd4a4618edfe32b423758527a7e544aa57f62c2e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
45KB

MD5
926d153615afd9c478f54645c0e50e68

SHA1
25bf98965a1530a912a824166320aebe3e391147

SHA256
c7db124f640bbe6048d638d8e63d533a35fb194455213a059f41d077c3489ecb

SHA512
7e35d56420ba437942aac269e333c188cc699d8865b8f65e2b7b7548644ca077d24d59b32bb59cfbbbef96d573ab8e6eb8f2893aae5189215791558e8907b48d

Download Submit
memory/1760-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1760-178-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download