4e65092cbffd5c5146f96965489b50702df50a962ca302855002fa48da6c9a5f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41a9fdd12ac8264733ec5da676aff420N.exe
Size

49KB
MD5

41a9fdd12ac8264733ec5da676aff420
SHA1

647e937ce2aa6740706112af7bc3f5a9579c5afa
SHA256

4e65092cbffd5c5146f96965489b50702df50a962ca302855002fa48da6c9a5f
SHA512

939b362ec1abe1b9997f009ca5ed9c350cc6ae5d6b600d3b979a8a0747c3cabf8fa4255867b8aa853513ab342923a136178026a797a071cf1e10fcc320663fe7
SSDEEP

1536:W7ZppApBULcfpHLcfpyD3C44enYE/FXHFJV+C44enYE/FXHFJVLei:6pWpBwchcwDm

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3081) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Noronha.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Beirut.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jre7\bin\wsdetect.dll.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp	41a9fdd12ac8264733ec5da676aff420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp	41a9fdd12ac8264733ec5da676aff420N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41a9fdd12ac8264733ec5da676aff420N.exe

C:\Users\Admin\AppData\Local\Temp\41a9fdd12ac8264733ec5da676aff420N.exe
"C:\Users\Admin\AppData\Local\Temp\41a9fdd12ac8264733ec5da676aff420N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
50KB

MD5
e3466ce0d71162aed5be8a0aa2dfcf33

SHA1
d02ef08b118e2635644355c7e20d433aad821f0a

SHA256
44e3203e9883ec607ec9df4e2059ff42c6ef501cc1c07ab58c857824134a0fe5

SHA512
b68b54d39b6701d38067d3314d33211e146967c0171bcda8031045ac06cab382f6fdf3e5cb4f99edbc5f6180e5e4866563ae6c036aeea841e88b564c9b5e3e95

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
a0a98676d552dd2e2206931ba8ecaade

SHA1
9fc47230b72f9b597add1de5e46ef5fd5f3994c3

SHA256
d98765bdacf5a43eb7aa1b0b400dbd57c7d289e79360511abd47fd6ee9242b14

SHA512
e3eaa43076b6b5d472d8e606b69f1d93a1c79b812bbc18a1046051bb0ae8a73093ed31c11d03c21106ab315bf8c7883c8f57e2ee60c184bd83acfc50d2327346

Download Submit