a40e81519b2f8e7e0bf84937121b0df4e0bcaf9fa150eefc800d6d4af921422e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9aae6c1ba03b79fe8af0a650e789fc0N.exe
Size

64KB
MD5

b9aae6c1ba03b79fe8af0a650e789fc0
SHA1

2754f8347cfab77a6a10eed44c7c111bc169c28c
SHA256

a40e81519b2f8e7e0bf84937121b0df4e0bcaf9fa150eefc800d6d4af921422e
SHA512

7ad4c9e592f4d98a3af81d3c8f6c1ba845c9f152ecde05a5150eb6adb1c8ac33e0c2f1b04004c8984adca34c92400eb83edead424c7ae13f9d650a40a6641e56
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/8O0Op:W7ZppApBULcfpHLcfpX2/Nw/Nwmxm

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3304) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jre7\lib\meta-index.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Xml.Linq.Resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liboggspots_plugin.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jre7\lib\calendars.properties.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.access.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9aae6c1ba03b79fe8af0a650e789fc0N.exe

C:\Users\Admin\AppData\Local\Temp\b9aae6c1ba03b79fe8af0a650e789fc0N.exe
"C:\Users\Admin\AppData\Local\Temp\b9aae6c1ba03b79fe8af0a650e789fc0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
64KB

MD5
725ace883278ef21bcb1dbb2142097fd

SHA1
51c4141d97136212bb58500c840f7676ba95a444

SHA256
35f6a9308f43afc5458ae17b306cc755e9ca86fb019fa1cde900cf2ce95beea8

SHA512
7274312b171972b7985edc1b747b17bad92ddd85e83648a6bc6f626e436a28fe9bef28b59ee02b0fe56a3c8eeb7df1f62666a4f644dd9ff525300e1f87ebba15

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
73KB

MD5
438af19f87e4cc8172fa6d4b2a0978b5

SHA1
078bcf37462212f41fbab3a294ee1b63210e3fa4

SHA256
a9500cded27abe7b62d2b84c7e756fb4625d1aaf1b8b59a3d80a746792d242a0

SHA512
45713d86e41996869751831f3862812c27b2519f40ea37ea17dcc70adf1e02f4e7e6bc7ac6d837f47d80b7a0325a68920536d235d8ad4d44b125cfddce67b5eb

Download Submit