1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c

Analysis

max time kernel
150s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
Size

33KB
MD5

08aad3ace781d66fbe36c389b0d38483
SHA1

bac7c440417c2b0a1871874a00bcd32a8d891600
SHA256

1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c
SHA512

78bf42f28d45446244ae50a0618e9d5437bbfbf965775ff6b7deb772add5fa253ed81bb9abb69cedecd299e7d7ac5f1387ab86547d41b96d7b504bb95c2ee771
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHhpqzXW:yBs7Br5xjL8AgA71FbhvsR

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1464) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe

C:\Users\Admin\AppData\Local\Temp\1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe
"C:\Users\Admin\AppData\Local\Temp\1f5b1ab2c406622e700748ab76e7d51ee8304198b103a2f32c6b3be7393dfb4c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
33KB

MD5
c4f0ba7b278e30b27c16497903a36272

SHA1
e2b6284079bb0400e7e431a6d6fa1943d77523bc

SHA256
81d925708b57a6eb3be2fa1d38c9074a3f31a624171f3b0ef48d62fafd6165fb

SHA512
e89b0dc74c282c881105fb8fe3422490034e7574cb3f49cbbf77d87e375d43e4b8918840145cfaf9dd94bd4cf50bdaace3e38b447c6a0866b8f795119e3707ea

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
42KB

MD5
860d9caf7c269be6c0818cf2aaf7c4eb

SHA1
b44a9a7b2a4b25cdc209d81229b1155742644626

SHA256
346d57f021e1fd379f431e41e9e95c2fc886f46c2336f2d20165e1fecbf02034

SHA512
248a3b417a3f7e1bb802bb31cb5955a30d9b5d44694bb2766110004159824150ba713fb9a95a7eafa5fe8122b67bbe20f24592729d1093744a41188ee5c3fb82

Download Submit
memory/2444-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2444-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download