fbb1f860c7b0ad5b7228875390c09aa580587eea76c05fba2fe7c0bb11c36041

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5ea6525ec120d2492e81131c71fbf9a0N.exe
Size

38KB
MD5

5ea6525ec120d2492e81131c71fbf9a0
SHA1

713bd07ecf6ae51a5de33d05f2809e73a9a10a61
SHA256

fbb1f860c7b0ad5b7228875390c09aa580587eea76c05fba2fe7c0bb11c36041
SHA512

7a38c3017c4f57a00746b36abc001c2d46cba9457c387dd3be109351d287dd0511807142a83765747514d2b5298e6eb36e0162cc015dc3e6da20877fb523c055
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FXtqAYa9tqAYaq:/7BlpQpARFbhTYajYaq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3228) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Games\More Games\es-ES\MoreGames.dll.mui.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-ui.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jre7\bin\jp2native.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jre7\bin\dt_shmem.dll.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	5ea6525ec120d2492e81131c71fbf9a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ea6525ec120d2492e81131c71fbf9a0N.exe

C:\Users\Admin\AppData\Local\Temp\5ea6525ec120d2492e81131c71fbf9a0N.exe
"C:\Users\Admin\AppData\Local\Temp\5ea6525ec120d2492e81131c71fbf9a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
39KB

MD5
dbe3d28f2f0b2885396882a3793760a0

SHA1
5eb70aafa10eb4df131e1088f389421a7287ebcc

SHA256
4692a27328c271834456494605ce3d0856f3f6245ccefc0db5949dbe8df8245b

SHA512
ba9a172dbd5a88056440a0614ffc709b6e8c37fa9f2d5906b1bbf6ee808a20286a5349eaa7d5fcd50853b305e9c669143bf636e3f5f2fe6c1d02a29d377bc549

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
48KB

MD5
da0b3ebb3280d81613c5f637f3c561fb

SHA1
dcf0f088040f0accd20fcd301201056a17c365e1

SHA256
01a72fe1ddb82f015f5d8d08e19751e83067e54e2158f7109a1e667d9947c250

SHA512
fa1193fe29362899470f5299f9d3daca84056eb8a86acf8b1c6111bdc444cd4d7226f7f9dfa49062e6675679c47c005ac7b85e1468b8d1890432f498c29a76f9

Download Submit
memory/2212-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2212-646-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download