54495fc521714bdf22c54b1c2c98171dda35ad5980b53e46c31d23d747270646

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0d539928e0ad8ba821597a5c5da9c40N.exe
Size

99KB
MD5

c0d539928e0ad8ba821597a5c5da9c40
SHA1

474a9f876bfc0c78bb8ce52afd6ab9414e54c45b
SHA256

54495fc521714bdf22c54b1c2c98171dda35ad5980b53e46c31d23d747270646
SHA512

4428e81be0dffdeb40e2695214b2f9d7e077e4f022d9a338b5a5537bc642f4642d89624044f4078615ec11f153300ac0c7075d584551acd4408cde056459faab
SSDEEP

768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmhyEXBwzEXBwuql:W7ZDpApYbWjIoPyPoLzV7c6Sha

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2840) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Makassar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_ko.properties.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jre7\bin\jawt.dll.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jre7\bin\policytool.exe.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp	c0d539928e0ad8ba821597a5c5da9c40N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0d539928e0ad8ba821597a5c5da9c40N.exe

C:\Users\Admin\AppData\Local\Temp\c0d539928e0ad8ba821597a5c5da9c40N.exe
"C:\Users\Admin\AppData\Local\Temp\c0d539928e0ad8ba821597a5c5da9c40N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
99KB

MD5
7da50f2297ce3e6126767e673f9f1d71

SHA1
0e07ce5370ef4c8c266530e342fd8b0007c025cd

SHA256
a8a89f07c6ac7c01cb3277a82195aa2c52eb550a6a5a4f7c630b456a2897a6a7

SHA512
c76f70fe5de149072164efd5138292b98dbf484812e9f78261a765b2e77cbd1eb48f173352a5b7787c700b756d6891b79e30435f5a19f55e6adeb50f81bd0fc5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
108KB

MD5
03183d2b21067d1cc656a3e2ea7ec3a3

SHA1
79b42ab64a8797403dc6dd63913e74a6aa46c8c2

SHA256
404eea0d931b0304a47359d39519757842aa7de88b71546f212655134b1b432c

SHA512
1b2d72e4178a911efb8cc24ef4985c229cacc09e2226e1af5f2b6cec1b1b227d82b2020bc0cb05fbef14f9c19052b97878ccd4ff659bdaa663607f462014f5cf

Download Submit