a3aec86af1962771437b60c5d9b56eaed27b884993ceb413c49b732b7c3be930

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04c59ea1ff63ead5d4d162dd8df5da60N.exe
Size

60KB
MD5

04c59ea1ff63ead5d4d162dd8df5da60
SHA1

0f8c215570b891cf07400bbd00eb0beb012bf85d
SHA256

a3aec86af1962771437b60c5d9b56eaed27b884993ceb413c49b732b7c3be930
SHA512

1c071f34ceb798749b6ddfbd8b47aac3d70ef2c0e9a6176622ecb375e73f8a4cd539a27225dc1012128a04e6a5abaad382941ebfd3e210d9492bd0b56aed046b
SSDEEP

768:W7BlpppARFbhknrAqQ/Q6JYAJYMMF/2AxXxX5Tv:W7ZppApktshJYAJYDVXxX5Tv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST5EDT.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Windows.Presentation.resources.dll.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\RenameImport.txt.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Internet Explorer\ie9props.propdesc.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp	04c59ea1ff63ead5d4d162dd8df5da60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04c59ea1ff63ead5d4d162dd8df5da60N.exe

C:\Users\Admin\AppData\Local\Temp\04c59ea1ff63ead5d4d162dd8df5da60N.exe
"C:\Users\Admin\AppData\Local\Temp\04c59ea1ff63ead5d4d162dd8df5da60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
60KB

MD5
dd4a122827a004f157eede6bc5b9501b

SHA1
8f7eb456c606e49bdbb72f67a5c5700bd81d8081

SHA256
5b18c613ea1ecf77a5e896a539dd6d81d8458cb5f41b0d6490e794517aabc2bf

SHA512
86f3df16b589bf7f912bc2e48c102ff8b62eb9d917ee15a7ee1df444901a3fbcedb945bebcf4c2e26802c18dbb7a9631ca15b57b930ecf14fe4d152bbcea5ad1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
69KB

MD5
551ff284cbb3302af43ccd38ee3fe418

SHA1
294a2439d2f12367c1595502170bfb87bdec8575

SHA256
fa400ebd886b93e359c697415d3306ff7b134694fbee7159a066339bc94eae0d

SHA512
944dbf29700eb0a4326949a54f4e9048661b2a1401201d26026467b68af15403783b9f0be1487b552c141e34d116f3fef7ae06beb390a8dc5920bb5e73c35029

Download Submit