2b982d95eff781b61adcd70022dbaecd915b897a8e9a9ef6a045cb2f8bae4e48

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

081e54f4ab951df5857acdd7eedfed00.exe
Size

53KB
MD5

081e54f4ab951df5857acdd7eedfed00
SHA1

8b4602bb7192f2194410bb0933b53a2c9bbd8c05
SHA256

2b982d95eff781b61adcd70022dbaecd915b897a8e9a9ef6a045cb2f8bae4e48
SHA512

2fad18fb48eca1509a822297f69fc40e72af2fb8f00f5541cca2da8d999a223be707ddadf235df699fcb1fb7f1b8cc33b15a81f6fe1a2fe2effde0582b063921
SSDEEP

768:W7BlprpARFbhJ68nNIreUYEreUYX1nE9P:W7ZrpApJ68nNIreUvreUunq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3541) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Windows Defender\MpCommu.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libchain_plugin.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libglinterop_dxva2_plugin.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_hov.png.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_up.png.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Windows Portable Devices\sqmapi.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_es.properties.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Windows NT\Accessories\es-ES\wordpad.exe.mui.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Windows Media Player\fr-FR\WMPDMCCore.dll.mui.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Net.Resources.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe.tmp	081e54f4ab951df5857acdd7eedfed00.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	081e54f4ab951df5857acdd7eedfed00.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	081e54f4ab951df5857acdd7eedfed00.exe

C:\Users\Admin\AppData\Local\Temp\081e54f4ab951df5857acdd7eedfed00.exe
"C:\Users\Admin\AppData\Local\Temp\081e54f4ab951df5857acdd7eedfed00.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
54KB

MD5
4d6aadd9e6148f75dbf16c1db10b9cab

SHA1
cd1154e981c276f89ae97966d5b0e279ecd48651

SHA256
9815f14cb0b8e89783cf7de03eb54552e33260824d7e8189dc67e44f303e81ee

SHA512
52f13a4c2f79eccaaf59b32115986fe18b632a02106589174912326ac3ff45696a58b0d9e00d0346cf16f821028932543653c725ad39557ece964215d3d9817b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
1125d75607d0983c395107b100e96494

SHA1
93d17f41f198c650c5f895d9dbab06c20d504407

SHA256
f28e90833fda7071d36e8b8c9299537fb8d6b383749a6e06b94c7d63cb24c33d

SHA512
ce6ee90b4f16eac8a8b157f32e449f8d7ddfe7a849fbb5ace6513e17ddbe0d0ee591a4a2c64127712190b01abf48ab1189e8c40af4d20a5952417baa60b537bf

Download Submit