85a9ac4b8e6d74283f95f2b0bd2d775369e5e2dafe4c7136a201f6445f481df4

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5574f6929ffb6a525059837d1625c350N.exe
Size

43KB
MD5

5574f6929ffb6a525059837d1625c350
SHA1

d99579728736612cf2da15b5172410ce376bc4f5
SHA256

85a9ac4b8e6d74283f95f2b0bd2d775369e5e2dafe4c7136a201f6445f481df4
SHA512

f2d9827017ea2c537a821c8945e5e8c5a63eeb3829ffd6188caddbbe1ce5be684273b3fb6322e346e653b23c13864684d6d09688f44952afdf9c98457a9d34ba
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNQFrs0AqAJwO1AqAJwOfF2JouP2JouQw5A5D:W7BlpppARFbhHFoqAJwBqAJwRJofJoTT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3249) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\DVD Maker\fieldswitch.ax.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-print.xml_hidden.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\vlc.mo.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-loaders.jar.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\vlc.mo.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Maceio.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Mozilla Firefox\osclientcerts.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp	5574f6929ffb6a525059837d1625c350N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5574f6929ffb6a525059837d1625c350N.exe

C:\Users\Admin\AppData\Local\Temp\5574f6929ffb6a525059837d1625c350N.exe
"C:\Users\Admin\AppData\Local\Temp\5574f6929ffb6a525059837d1625c350N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
43KB

MD5
498bfe08b541e84c57a516bb0d595610

SHA1
3099815b816900164e919791ff6f09276f65693f

SHA256
bab6874e22c05a325af4d21569e269c1f092f3677e72b8b95c388dc51607b95e

SHA512
1a6748dc69e08f3b31868124d2d176d42fdd0bb73cc59d3036ea0f49188b42aadacfb233e5dacd867c9cd63521ff94db75ec43c3bb2d4370a6d289a89a855396

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
52KB

MD5
6e2a90fcf6ca2fef15f105b337b48635

SHA1
d5cb7f127e5bac2848da6de101fcc299c8559c96

SHA256
366d5f2f8002c206a08b84abb392009328ddbc757004566d77c1b40a8f4778e9

SHA512
b11e34de4fdd706841439224fcb90d72c38b6711325dae01cbcfe2bfa96c92e62eea5fa39086413ce610673639e2e54484a8027c967dfe0f5aff4ce3b1ac17f4

Download Submit