1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
Size

43KB
MD5

d11fa65d1d56fe9846f1d2d5d0057f1e
SHA1

3eb1d201d226a0cb96e208a096770a0d279c300f
SHA256

1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055
SHA512

b43f3646de8a369428c15af27db629b289299e2e9820be059f5c8fff198d506c34ef4f1c28556a3a6c510021b42caddf49b2b7813d9539eb71045876e7027394
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c5gQ4NQ4L:W7ZhA7pApM21LOA1LOrtkpt6GQ4NQ4L

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3765) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_QuickLaunch.png.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jre7\bin\ktab.exe.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\settings.css.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRdIF.dll.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\settings.css.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\10.png.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\gadget.xml.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Madrid.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\flyout.css.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\glow.png.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Windows Media Player\en-US\wmlaunch.exe.mui.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ACE.dll.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pago_Pago.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libgl_plugin.dll.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jre7\lib\content-types.properties.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Windows Journal\de-DE\Journal.exe.mui.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.tmp	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe

C:\Users\Admin\AppData\Local\Temp\1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe
"C:\Users\Admin\AppData\Local\Temp\1a4b16f47f6e062b0218b00d7dce54a00b6a0a6eee78563c209fa58ae53d6055.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
43KB

MD5
42acbfe07929aa298892ad40ed2e3878

SHA1
d2d0ad0b096a493f69c7cb789d37266aa5bbc5f7

SHA256
ade2113b2f4a02834ba780987c2a20fce194db1aa743229c93405020236f7b63

SHA512
0f6fae06d0e42517505d63af244a04e38c71b266be66e474f4a9d7f55577f636a785b6432b0533da7fbe16ffed23bc8c2da0a17761041d54c06609a2fa7f972d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
52KB

MD5
08a1f3df67868cdbcce9286a83b2fb50

SHA1
4409d5b05d4287e604b4e340d6c23ddd853435d7

SHA256
5bff026403ff710fbc95a270aabc801acd17debe17c6e7f7bfeb56e16560e8da

SHA512
0d0c4784c83368e174381c73e50618dcd31f3ff78e8a96c55308edc6749150918a0e5db659f20448e0aedceff55136b4c91f65bf4a55b01270f6d0a620823160

Download Submit