61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
Size

58KB
MD5

dc6bfefbcc6695aabbc05a0723c9df36
SHA1

21d1212faee145ba147171ee5b15707b534ad30c
SHA256

61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31
SHA512

8e945c7a5eab7e45d5936e3909ef5816f9c8f42ed99ea8c7570d085bfca36fc3d2bcb293ab0cfd2f3cfb0ffdfd1aa621fb0e7dbf47db2041fa0963b6bb5f540a
SSDEEP

768:/7BlpQpARFbhq1KX101je2/Qdme2/QdAe2/QdDe2/Qdme2/QdAe2/Qdqx:/7ZQpApq10

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\gadget.xml.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.bfc.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnetwk.exe.mui.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\clock.css.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass_lrg.png.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Journal\de-DE\jnwmon.dll.mui.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\weather.css.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_few-showers.png.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.log.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_m.png.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe

C:\Users\Admin\AppData\Local\Temp\61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
"C:\Users\Admin\AppData\Local\Temp\61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
58KB

MD5
e540e41c2126d24d69fcedd214010d5c

SHA1
a40882ded5004e70191c218fac1a5c53b00d520c

SHA256
54af124cf08b2679878022991d12e95918416cf9520234252acd9c1aeb1bd2b6

SHA512
7c539ff50354e6c554d329e90cdb2e8a9f2949abed34f25eb40551d2aa14768bb2da26df5bbf8a87357a181695d7f323548117de839c506d46bb3a48f2df019a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
67KB

MD5
44fb576b1c06b246e510cafbc5437ddb

SHA1
ed00ccc3748465467ba608384b813c74b40aa467

SHA256
1235f14223a3a5fc5950c2c9d2da51a9697dce1b8647e413e41b7ae1142cd7db

SHA512
004b24884f8cf134d593fd77a622627269fdbeb785ae4eda243aeb74024f82b47b1bec3faf69fffbec5580897ea02b5df286ad603e1d62a606ebe58a4c629c2a

Download Submit
memory/2624-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2624-648-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download