42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
Size

47KB
MD5

80345d93aac3d5101c234fa9009bb4ef
SHA1

bb8700ab75b85cb43a4cc1acece8e8de971f2c22
SHA256

42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0
SHA512

ec7f542ee9bcb72792409993758a76b487d0070cd0a0e4700cd2a0825c907b5cb39d97f6576c054af1e164b019183edc7d3327fdd60152401b1c76b0b13abd50
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLa:W7ZppApBULcfpHLcfpyDZ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1174) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.tmp	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe

C:\Users\Admin\AppData\Local\Temp\42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe
"C:\Users\Admin\AppData\Local\Temp\42f00017e2d1afe6b9e00ee5777ecdf954618f962e3da893aa5c5335363643d0.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
47KB

MD5
276f16557393d8c3cc5335d89b1be589

SHA1
a68598c4ace3b30efd45285045ea004292153c37

SHA256
08a6afc41e3124a26199659d28eb4e6277b90145c9af776bd7de6f92f6ad4b28

SHA512
060f4b15bdc48261264da6f1c71096493040e9e8c9c445f3b4645a58857008d7f4b3af02447a15131b63f874bf8627f9d3e3f2ce217dd743d49d103daa4253ff

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
c2bab966856df52dccd6949d51264caa

SHA1
bd5d6fe604977c2b17cbbb05d7c376b574e41890

SHA256
742dc97108196598814d7b18599961b30f5dce3585562898d91b9c3fb7953f82

SHA512
ff4b4e38908fa0f3f20e98853b1e9b0709f0d589ef08cce9d94417fa1b5ef30513cc26664cf69cd94d603115cc8934d3ce9fc7131d683386bfd8a51d16f65aaf

Download Submit