4858cc5025b20959b1ecd8277433dc171cdcd19ca3dbe5cc9e90606cd3e614f9

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5c2540f4ed94aec0aa1a9f561e52e30N.exe
Size

49KB
MD5

f5c2540f4ed94aec0aa1a9f561e52e30
SHA1

86439d8ebdf1756928f88f953630d3f9259f444b
SHA256

4858cc5025b20959b1ecd8277433dc171cdcd19ca3dbe5cc9e90606cd3e614f9
SHA512

ae763835ca5c5943fa953485636e9a2c7668147a7aaa1f4c05d17bcfb020498386a439b73c3e3629f70cf5c7b12edda11cd81c2c7ac233ffabef0c1245806fee
SSDEEP

384:GBt7Br5xjL9A7AgA71Fbhvnqj7jU7ubTAgpbuvx10AaIdKB7ubTAgpbuvx10AaIw:W7BlphA7pARFbhL801VvM801Vvv7cYy

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3229) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre7\lib\management\snmp.acl.template.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre7\lib\jfr.jar.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Hermosillo.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre7\bin\jli.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\DVD Maker\Eurosti.TTF.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5c2540f4ed94aec0aa1a9f561e52e30N.exe

C:\Users\Admin\AppData\Local\Temp\f5c2540f4ed94aec0aa1a9f561e52e30N.exe
"C:\Users\Admin\AppData\Local\Temp\f5c2540f4ed94aec0aa1a9f561e52e30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
49KB

MD5
4566cdae4b9c82d360d488aeae7639a1

SHA1
0287eab060d4515eb0c31aa557265a5124e3a438

SHA256
9bd401d4da2f08c170ff6da041fa957ad3f415719082e4d9fc564f5e43b3ae17

SHA512
1fa99ca6c44ba8101299d0b68f2e01e38893306bf0bf4537eb4a1c13f29d1cc18adcb833753f6e031a08ef1eea300ae1e58de6d1903c8bfbf2d9e4ee14a0a9c1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
704aafa0469a9521f74509868dc6a2ff

SHA1
dd828176cf184b9133e890038cb96efe3f44178c

SHA256
a94a3dca3f39951c262735f88056d137bd875862733ec6d560a2ab9854360245

SHA512
a442efb2b21e518d726bd71ec0a173be6dba17b22f4112fb9bd6f366207484c7cff91e21baa8cb2cebc6bdfa1bd3ff6de88bd4501da80dbd1e9524d806a20c53

Download Submit