a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
Size

42KB
MD5

2ddd3757f5394307255ab19277141356
SHA1

d56f2c53440164dedb682d6d34251765b415f85d
SHA256

a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc
SHA512

45e9cc6710ea292f7b90bcd3aec170d4f08ae868d9cf8133edc375f135fb83c0f31642af65fe606065b39ec093ad3b58699d2e94f35ae7521ab27a1d57494e37
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpW/01zh:W7ZppApBULcfpHLcfpB1zh

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3878) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\45.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_thunderstorm.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\flyout.html.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jre7\bin\mlib_image.dll.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\STINTL.DLL.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\TipBand.dll.mui.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\15.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_foggy.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\localizedSettings.css.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEERR.DLL.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Windows Defender\MpSvc.dll.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\16.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\VideoLAN\VLC\skins\default.vlt.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-favorites.xml_hidden.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\VideoLAN\VLC\skins\skin.catalog.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\pdfshell.dll.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_m.png.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe

C:\Users\Admin\AppData\Local\Temp\a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe
"C:\Users\Admin\AppData\Local\Temp\a9cb8e7eb949eaa8d2c47433291baea973e3e32f7480ea19f8e5282a522663bc.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
42KB

MD5
420b44c83003c5ff0e5c1d0602089a17

SHA1
bc4e0fd424f9e30692a7243f23dd3b032c0cc8a5

SHA256
6dbe7ea071cc943a239205ec9f3bb5c28b779423683ca7f55f388ae03baa6111

SHA512
cabf4d4c1b215e8107923d47aa3af05a92ab493c3c58a73978768b0b99fd1ac42e1db57b6818abf97ffab950b423671e4b6dd07e0d637b9969065e7447cdd6c2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
7ee7eddce83b621a016a8c6ec269bcc1

SHA1
e175d306d3c5a38bb2384548f59e3f1b1230ef24

SHA256
bdefea5c0c5c2bfbf5c5e7030c96fd11f367731a56f817e21b0e0cda578733c2

SHA512
6a4a98d1edc3bfa43169d5a23d75f8ba1cda94b7519290f569553636499df30362ff75e2b1f514a6139defdfe365d51d8895a0fff04c0daac0fc909b85029087

Download Submit