16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
Size

50KB
MD5

685b8cbadea0b02578c4ca01186b854e
SHA1

082340bb6fac0641fb38e3627be186c2f86563ef
SHA256

16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df
SHA512

f668b0a86ea03422afa443b53c081e5a60c6d1f1eeacf8d1498792417cc45dc8efc50f917eeca2e7dda162d48f0010a1c365bbd8bb3b0881f0335a3f9d27b2ce
SSDEEP

768:/7BlpQpARFbhn54fmiy+3BVr54fmiy+3BV6nkSI:/7ZQpApmi6nkSI

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3788) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\init.js.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ViewerPS.dll.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_h.png.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Windows Defender\MSASCui.exe.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_dot.png.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Windows NT\Accessories\wordpad.exe.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jre7\bin\policytool.exe.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\settings.html.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDFFile_8.ico.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxC.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\gadget.xml.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jre7\bin\jdwp.dll.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Mozilla Firefox\qipcap64.dll.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Windows Media Player\fr-FR\WMPDMC.exe.mui.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll.tmp	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe

C:\Users\Admin\AppData\Local\Temp\16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe
"C:\Users\Admin\AppData\Local\Temp\16faad7aa3947b98cb937830d93a2873fa05daaec0689b8f68e62dc43be7e2df.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
50KB

MD5
193db706ae11bc75f937cad995f92ffc

SHA1
51a9a6c5e3f7131e9a790911c9e4ba1189aa2db7

SHA256
881f9a3bda1047a920907da692eec99d1381b35db3be1a3a9dc34bd1c29816d5

SHA512
bf0bfa4d4e1746ef3f8a88e992697abd28a879d95797663b46c36b20dd35d0bf559e7f881027c8f50829b2c14b3ecf85a6e5f148d937ea1a160f246367f50499

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
c0ec48625e205fbe0e8b56f63e41131e

SHA1
5309c1540406eeece6315f1aed386ceb59adfe50

SHA256
d3e7a029c2e1e34608a4cf928c70f5786a2a9bdfc7188802653c54a8c93f8a4e

SHA512
3f7421bca2dfa8c042619a059c655606ae3920808799068546d42702ca4a19063e93554b64329b00b9cf9958413f64f92bd2f91698b2e0567af10d665e001294

Download Submit
memory/2392-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-664-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download