a2b4815f7851dede8afd3996a633b737e4d92c9576d7c3832bde454c7beabfbc

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

825d14dc71a4be039591493acc92f780N.exe
Size

59KB
MD5

825d14dc71a4be039591493acc92f780
SHA1

15d877f0ce39adc968360993a4ab50b4fcc528dd
SHA256

a2b4815f7851dede8afd3996a633b737e4d92c9576d7c3832bde454c7beabfbc
SHA512

b9c91f2e34ea0b2240b68e34243792aa02f4718438ab747b639573beeb5223f53ad655d9292e1d3a8c2e09baadc2ce029ed3f4625d2b426581e1d7d5d34a1bc3
SSDEEP

768:W7BlphA7pARFbhOm0CAbLgsNCSNC0K+R8PERuV3u5jwhh/EPP/E+vWi+/E+vWiDv:W7ZhA7pApH16m3ueTg/fu/fj

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3321) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Inuvik.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Mozilla Firefox\vcruntime140.dll.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Mozilla Firefox\libGLESv2.dll.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vienna.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp	825d14dc71a4be039591493acc92f780N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\vlc.mo.tmp	825d14dc71a4be039591493acc92f780N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	825d14dc71a4be039591493acc92f780N.exe

C:\Users\Admin\AppData\Local\Temp\825d14dc71a4be039591493acc92f780N.exe
"C:\Users\Admin\AppData\Local\Temp\825d14dc71a4be039591493acc92f780N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
59KB

MD5
747fb47cecf0f6afe062620f85a30de5

SHA1
d76ea09295c288e913b8d28b6bb205b42bf14e98

SHA256
7131513309600547df04606cd9bbef5b22226432e15efe13cdc3fa484f2b5287

SHA512
2f18f3ffc1df26028a97702755d7e9d760459c2a408d4fb5864946a61cd42bd1e434ad0013e3f120416a807d29cd139ec36fde6acba5fd8c29739fff68f0e063

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
68KB

MD5
23101891e63a56366b15c623f1375717

SHA1
1907651773d184204b31d7dc6b9244666e49426e

SHA256
4f712c6a688d490723133f1a5a6415ce0c43052bba6574040e7f798043d92535

SHA512
e3b99f1ebd5adb3b837c4ea26945d8cceea0b38223790d634b01a64b82e82ae0a652fbaf01a63bf2a00fca1b8b832b77bfe40d896f3913a8909829ec7249cd2e

Download Submit