f78e1c42cf052a7507e790528be608af66709dde80c70c8f9e06f94dac3093a1

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
16/08/2024, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41a503a19fb187feb2606d60d3b99d40N.exe
Size

47KB
MD5

41a503a19fb187feb2606d60d3b99d40
SHA1

e8adacc67c3e4c21a7c17e10d410252ece41879f
SHA256

f78e1c42cf052a7507e790528be608af66709dde80c70c8f9e06f94dac3093a1
SHA512

4947df6736e4d5a4b317ad301bca04de3cb00d1fa8d64f6272644e8159bc68b8c8cf9956768232e5d2f9251c4e466e034cf17773b2b3fd49fffa2e5d5dff2884
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJwNqikTqikkvPVvP18V:W7ZppApyqikTqikp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3275) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ust-Nera.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Berlin.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp	41a503a19fb187feb2606d60d3b99d40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	41a503a19fb187feb2606d60d3b99d40N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41a503a19fb187feb2606d60d3b99d40N.exe

C:\Users\Admin\AppData\Local\Temp\41a503a19fb187feb2606d60d3b99d40N.exe
"C:\Users\Admin\AppData\Local\Temp\41a503a19fb187feb2606d60d3b99d40N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
47KB

MD5
d177c25272ba69235b2ca58a1d674b67

SHA1
cec37fa3821adfff74e6385d59db43eb9ba7bf04

SHA256
068bb778e6eaf1e82b21ab1c4184ec6cf70d8c66a2b7efbf5c63909c2130feeb

SHA512
70ef067bd54d6d92146826d8125eed9643164bdfd7c84bc367dc0e24c8f0f2c6ed2cbb661ead4e7b1195d31cecaa2280fb18a633196b1bfcfeca5c95695aeced

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
b28b1dc5de482719b3d26c864ddb0096

SHA1
bceed1adfb86bea3ccc68484e3ecbe5bf46919a1

SHA256
5decbef3d897244fdd7e0e3a14e0d49b6d8122f458fb08e49afa3c741f0649e0

SHA512
a6fdbbbcc1998cba608e2ade5c1467974dcaf02e01103f157926ad84b8792b5db61f9c2900616ac4d031834b5dc1a8451f1c48ef3dcafe8b249e67865bb55042

Download Submit