fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
Size

71KB
MD5

29256c9386cdff1a4e172cf3930d3f1e
SHA1

4ae19151473e57fab8dbdb98192b5e8453f4a828
SHA256

fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2
SHA512

dfb23eb8aa338da7fbb12bdf1e910c8394f09ee8a7c79bad1baa32025191fb12396e1d60ac841f3a5607b772ccac4e0379889869e883ba291602013e5f55c674
SSDEEP

384:yBs7Br5xjL8AgA71FbhvJUfWGUf2X5nUYXxX5nUYXyuXvuXnyCxyo:/7BlpQpARFbhiWbs5nd5ntXWXyro

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3474) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\gadget.xml.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-progress-ui.jar.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\flyout.css.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nome.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Sidebar\ja-JP\Sidebar.exe.mui.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Defender\MpOAV.dll.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full.png.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jre7\lib\meta-index.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Media Player\mpvis.DLL.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_bottom.png.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_hov.png.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Journal\Templates\Music.jtp.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\SearchAdd.M2V.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass_lrg.png.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe

C:\Users\Admin\AppData\Local\Temp\fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe
"C:\Users\Admin\AppData\Local\Temp\fb5e9471dffaf2ca6c04e640a233d470914878ca65f5c4498514c01d6f023ba2.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
71KB

MD5
694054009da18c0db784cc7e80d6dd6d

SHA1
6d45d4b3a1280d0c7df172e9a2dc76cf8840ad03

SHA256
b443070d583f1791051fc898c0b0de8ad72280c0b2082e82904286718b926a0b

SHA512
e144638a2db0132d15ac86870f8206163bf49692cf02965fafff6b990d15436a9ae0eddfab2d0050f7b11dc52f4fabc1ce65e9d6d53371c4b537e54e4e7a2c24

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
80KB

MD5
cf25ee58f75562a13596c30e8cc02a66

SHA1
fe4fe90bb54affebd5e97b84ae3c568a53bc7737

SHA256
d88c198fa53d8494c4ac96c71b6002319bbb6b6dc9bbfb525a3bb1a03c14d32e

SHA512
7a633ee007de2f6785e1fb635c5572e5d7288a3e817c021dbbcaef365170f8dd34d87e63ec461278822eadc942651df4d0d67c266b5a1d2b8e2f2e841eef1fc4

Download Submit
memory/2988-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2988-646-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download