6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
Size

39KB
MD5

90f1316f2d7890786227f9db8f62f113
SHA1

1ba39be951aab9a92a83edd17fe416faa4ceda89
SHA256

6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22
SHA512

c581c3789e213020f216d0d0990d569f0727319851e0664853d35402e146886ed013b060c1650bc008f88e4f9bc52790b1ec46d202b818e6fea8788c04ba21a8
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1X+E:W7ZppApBULcfpHLcfpSo3ft+E

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1235) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Accra.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe

C:\Users\Admin\AppData\Local\Temp\6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe
"C:\Users\Admin\AppData\Local\Temp\6aa47b4bc015d63e4720387cb5bd9687fcd563df53c001192381238d30028f22.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
40KB

MD5
ee8d8f8ae51ef9fb14e0174703da2646

SHA1
acbe9f6a13b396e9711b8ba75f7244fc1cb42df1

SHA256
b6f094addff879060359cf24324fed6d67354b6b2f6129e41da88dc17607b763

SHA512
1a4156a237f4de5d0e1e1c56df5611daf5fdc5b490429705316469cfe32bc7ddb451b77a0999398d92d6c669ed32c88e2652ee006e7ccf270e02ec995b0f3e70

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
49KB

MD5
d2e121913510fb4ff3943988b0075d95

SHA1
635eaf246854ec7aae6c04a9086c82c081412d28

SHA256
8b11fe5e8fef96f4851c6eae9126c677113e6f951d53ef11defa350982035018

SHA512
cc59fa5c33746716aa45316d4a43a878e6e6041602686fa3f51ac69384f0ee1e67290b0e89fca1023552d2b4a959f3a6ae293673b1de9e8b3175d96e38acc5dc

Download Submit