fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
Size

40KB
MD5

ad7939404a524eecacc1ef0281fb7780
SHA1

af51001a4e0c26bc403cfdb5e722c8efaccebb5f
SHA256

fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad
SHA512

dd7cd7e18a20874e5122f444a06663dc41502d086ab10fe57d799b15aab86d044bf646e0723e6b720de0e79ae862772bc3bf98609cbb85c42264206cf2429c47
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFdHFNFVKU:W7ZppApBULcfpHLcfpyDbD/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3700) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Windows Media Player\en-US\wmlaunch.exe.mui.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jre7\lib\security\trusted.libraries.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Windows Defender\MpCommu.dll.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\currency.css.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Lima.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Palau.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Mozilla Firefox\mozavutil.dll.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\slideShow.css.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_over.png.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_left.png.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Mozilla Firefox\locale.ini.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Windows Journal\it-IT\NBMapTIP.dll.mui.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mazatlan.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_windy.png.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseout.png.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe

C:\Users\Admin\AppData\Local\Temp\fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe
"C:\Users\Admin\AppData\Local\Temp\fa1772954c6f62281a283f3d45b5f9e8f14c28a990a55daaf179a3a1c076f3ad.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
41KB

MD5
fbc0576bce0e46db74d112a8b2a7e00c

SHA1
b42a5c76b6d9d8a593f654199a69833d6308bdda

SHA256
947682e8114bcc4092cda9f610d67cfe5e5d6ee875c78def8880a677ac84ab5e

SHA512
f68a842661f43a02110877252c638768103e9a67d4f44ed8e5929fa953fec3f052cb708bbc5a3fc8efd4735545c2554871fcb1b4112b11b4c486676a91b1685e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
50KB

MD5
9c928ba4aea409229decb1f87a4f82a8

SHA1
b0c0090e7364098a4b654a5df2f18b1af3817317

SHA256
0b522d5744e19037e3e3ba7d180e9374c1b58435e3f68e2cb56761b6d52a5796

SHA512
ce709b96eff4e51dfc92b18565f8d28b47a7028a306aa081eaded2e66d853790b89110cc770805482af4e23496c05e747fcd73118d847ac3fcb06f2fc37d269f

Download Submit