e13b59e6ef25540f978d4a2e499aafed4702cc4c3aebd7a968f32d4d809f0c31

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/07/2024, 00:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
Size

53KB
MD5

1fdc5dd849430d7f56fe9c1cbf36dd50
SHA1

184f742bb1b2e4fdf228d4aad6c3b4391e40fc46
SHA256

e13b59e6ef25540f978d4a2e499aafed4702cc4c3aebd7a968f32d4d809f0c31
SHA512

77f8633d425230645c8c82914ebbd4161093eaa9d80c39f30db09889724da621db3ae559c425e053f60c12af432a1b426854a8dc8ed28eff459bdeed08162944
SSDEEP

768:W7BlpppARFbhwEnAAJ+AAJ9vcYNnVvcYNnfy7/d:W7ZppApwEk7n97nE

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1563) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Internet Explorer\jsdbgui.dll.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4ADT.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1fdc5dd849430d7f56fe9c1cbf36dd50N.exe

C:\Users\Admin\AppData\Local\Temp\1fdc5dd849430d7f56fe9c1cbf36dd50N.exe
"C:\Users\Admin\AppData\Local\Temp\1fdc5dd849430d7f56fe9c1cbf36dd50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
54KB

MD5
bef8dae2901fa4f5c2179d653176fee3

SHA1
3bb612a01f02b468c6358c24f938a0849f16555f

SHA256
2475f1802b97db4939c35f59bd6f790f1da9243c40604dfc8609221e083a888f

SHA512
aca3775c307ed1f89f3583e7cbd0ccd6170add06fe29f99605bf4be0d8294430cfd8937bf7c3e08619f4dd55ff135fabb3c97adc05a65d6e5fa5ec20144b877c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
7d13a3a4e6fa7dadedb37b447cb78317

SHA1
01c47d751f0b32a5c78476a73e4185b711c606bd

SHA256
4447d34d1bd235cc5363565a8765d7d48c67c5a0419c85b3168fba7a8d234798

SHA512
82047148666050b4ed114016c46eb04c5b2c7c2e3e00fa13b92562b334f874a35768eb8e48b2baeaa2a9599be395632e25f956800bcae52391fc977b84ec5ead

Download Submit