c17d43443adc03299a39153b028848ee67baffb67f7276b8c27cc4c2b8284124

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
Size

51KB
MD5

4ffd43f2628cca9d4f21a0dbcf89bcb0
SHA1

b9ef18ef18fd2c5e441bb817284d23f9dfe1378c
SHA256

c17d43443adc03299a39153b028848ee67baffb67f7276b8c27cc4c2b8284124
SHA512

00185d9589d032b6b3a6c8889697c2eda2aef17a2330fa8e725320c56a9f7c4f521a34c35c91bf647322637bbe7ad2ac0fefa1741244c55ae882507766bc3874
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFew/DbAGw/DbAvnscNocN7:W7ZppApBULcfpHLcfpyDoAvnscCcZ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3221) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.access.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-progress.jar.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.tmp	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe

C:\Users\Admin\AppData\Local\Temp\4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe
"C:\Users\Admin\AppData\Local\Temp\4ffd43f2628cca9d4f21a0dbcf89bcb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
51KB

MD5
fd0013de7bb3f44e7b17be8ae0fd4054

SHA1
e49bd4e9ae503ada044cd0a129813ae891dcf4bb

SHA256
35860d5a500def687a1deda2e7055ebf41085935982c059698c5382e837bd82f

SHA512
6ee72ede5c13005584e6e83ee49cb3b9dd9737833df437c712597c2186477f5ff354047e25154554d6ab5812b55fbd47598886e0db6c564167c73e6ca954cf4b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
60KB

MD5
036eb8f169a64356c151ad4cf14cd239

SHA1
344c35f7b72f2cffd5870bcd9adf441a2574c9f9

SHA256
e441092cabbb6796c55faedaac8ec87f89782c2ae7e9d61e823d4fb081df21f0

SHA512
2936468c8cc1c4ca8011a58f1b847f800007bd2343aab4688a4de3028d90fe45fcbb5e9ba44b7da2503cbb0b56b8551ff17c51fc11670cf1d1aa7d6cc1b79b89

Download Submit