9179eb1895a9705549993adb37ef8bbf6220462f5295cb2f41e4672b3ebc6a1f

Analysis

max time kernel
119s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05bcc7def2963674f7607f10bd288ef0N.exe
Size

43KB
MD5

05bcc7def2963674f7607f10bd288ef0
SHA1

2a54c947caad0d3df6d1309b1de24981183621f5
SHA256

9179eb1895a9705549993adb37ef8bbf6220462f5295cb2f41e4672b3ebc6a1f
SHA512

841953fa73d14a0d124a626b1af0d4f8d7db19e79a307d96a4548e9286dd0464573f72c2f56cd85692a7427286032f61748e2f366a0412de61b6ac5c23889f79
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpT4wWlsAtJVsAtJ5:W7ZppApBULcfpHLcfp5WN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3456) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Almaty.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_chromecast_plugin.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\VideoLAN\VLC\skins\skin.catalog.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Accra.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	05bcc7def2963674f7607f10bd288ef0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05bcc7def2963674f7607f10bd288ef0N.exe

C:\Users\Admin\AppData\Local\Temp\05bcc7def2963674f7607f10bd288ef0N.exe
"C:\Users\Admin\AppData\Local\Temp\05bcc7def2963674f7607f10bd288ef0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
44KB

MD5
935828360580047b87f8c15ddfd48da7

SHA1
cb53f503c0aa169953430f1df3349adc0c25430e

SHA256
1580884e7a17c324784a6d66770593c5c3f42dd3ec0204729290d55dd3de8352

SHA512
f9349f53a95afe3019c2d7bb0dd596140a7bdfcb6af1174028d89faeae290c85a0d2fac3b06e85f76837d0c70996b231931de5dc4f9d416aa88f12c9f29b5328

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
ecec5698b05e492660590f052541bd74

SHA1
f8af7a2f217354c2123ce8ba4bac9c037c9ef34e

SHA256
d3c2fba2936dd838ea51eb143418f29d0276b5c1fc7b7883f51017cd30529fb8

SHA512
cf2f79702fe935f6f5957e312aa06c407d5bb63716a50c63e7846915dddaf341167717d4655b4a91659a10ee21afbcc28c783344fb2330ade11a7d97615fcce7

Download Submit