be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
Size

97KB
MD5

86db88ec691bfa4e18e3ff93139b6c07
SHA1

b584c5c7783c041e66095647b6090306b2c50422
SHA256

be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b
SHA512

caefd1cf773bdc06ab86653e4956d631c51aa9940554780020b64458cd8c7ebe8f0def81f4c80a6ca7f30693e1abfe9193f52c7fc86daadf2e24f234d7f07d21
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBB:PqFF2Ie+efsLV

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3627) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent_partly-cloudy.png.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Marquesas.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\flyoutBack.png.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClient.resources.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libes_plugin.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\timeZones.js.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\background.png.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_cloudy.png.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\VideoLAN\VLC\THANKS.txt.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png.tmp	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe

C:\Users\Admin\AppData\Local\Temp\be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe
"C:\Users\Admin\AppData\Local\Temp\be55034582c7049433e4e4a21a03a3ceceba4f12908aa76660c3f463c597581b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
97KB

MD5
a7d3f9661f4609fef2cab35f4c0bfaff

SHA1
33a70c09d9ea7aa4c5aae0a88634bfae3520c0e4

SHA256
2956171012f2329244850bbfec5b8d86356758a9460f132be904aa9d50dd5c70

SHA512
3eb29b48136653123ed8870eb95e0b76055c6ba3f25d82ad280e49c8e82fca01b17e4a3234dc18ca66a86dd42bdb168f6461e40f83a1b1aa15883ec68f5bd7bd

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
106KB

MD5
c2b4cea94a4a1991fe0b7de8f09dc437

SHA1
550dcbfdcc0f58dc32059b4297929db20e207196

SHA256
063e7333c2e7f47d9857fbf34695db0454d1f7266f0d2fd87541b676635448e7

SHA512
4e628583f88f7d882241c3d42626c943be49ff099ce58ede80f3a40a9b818034771adab5a099fb8b00c1b1f7c525335cb67d6b6d712c389ffb81d726e227b08e

Download Submit