3aceca468c434056554527785c23f6d2734926aa26b7a557e40b42f67cf41a3f

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4330d60a9ba05a1d5f000807c3c02a0N.exe
Size

42KB
MD5

d4330d60a9ba05a1d5f000807c3c02a0
SHA1

051c1c2418afb1a711d6624f8d9a295b155b02c3
SHA256

3aceca468c434056554527785c23f6d2734926aa26b7a557e40b42f67cf41a3f
SHA512

d7dc1f5a2c8275d4630e4b376d3d192d8aef58fb7b8e7c9bf740775df931e6d7de05fa4628defdc72d1b5444e98e6080a60134c299fda4101210a0a43614d4ae
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FzzwzrYcUYceQ9HsQ9Hr:/7BlpQpARFbhNIrYcUYceQ9HsQ9Hr

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3322) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Minsk.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libmpg123_plugin.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_ja_4.4.0.v20140623020002.jar.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Internet Explorer\F12.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Juneau.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Noronha.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\CloseClear.ps1.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre7\bin\java.exe.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp	d4330d60a9ba05a1d5f000807c3c02a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4330d60a9ba05a1d5f000807c3c02a0N.exe

C:\Users\Admin\AppData\Local\Temp\d4330d60a9ba05a1d5f000807c3c02a0N.exe
"C:\Users\Admin\AppData\Local\Temp\d4330d60a9ba05a1d5f000807c3c02a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
42KB

MD5
dc3ddcab6c1e8118c59e8d7eff049bab

SHA1
b747f7ed8e05086202f394dbebe97cac61e726c9

SHA256
9d046e33edee746fcc649be11a59e67327b734d40a77040696389029e56d67ee

SHA512
485e269447a380e793893a2f78b79ab91e7e10407a378c5672d5ea9e15ce68c1d736b7ff58bccb54a72eafc0f68ad641c075043d024742ad2807cf6ef46bcf18

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
f5dce0ee743268098aa46f7261f103ed

SHA1
65b11cd709e323ab96867d3d375149ad0297d5cc

SHA256
05db77ece00fbc2f7539941d9b73d4f7d342e14d818242ec9a6fa82a4d8744e5

SHA512
a090e8d767b88e5051242bba062a26a5e08dc8b3f11bfd35f966a7277b3767c4060ed7ef9c47f258aea16593e077aceef299a8471feb5fe887fed08e8505373c

Download Submit
memory/2576-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download