afd0448a740e3d7a03fc35e81955930f264ac38f33c9e4ff12b12cf8609e41a4

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d18444a4ba422403bd973bb406ebe90N.exe
Size

102KB
MD5

4d18444a4ba422403bd973bb406ebe90
SHA1

260e36779ef4bb44fed714ad3a0c0872f50d60d9
SHA256

afd0448a740e3d7a03fc35e81955930f264ac38f33c9e4ff12b12cf8609e41a4
SHA512

24f289a405b48e170c08d292bd41e3f402850b9b1052bdc5599f82cc832814b558b39524b53127122c503c94637bffe4282d3fabe2f099b5f112b03e8a7f9755
SSDEEP

1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPIUpCUpiP6:6DWpwE7oL2e+efZwZ08i87

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2882) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2ssv.dll.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jre7\lib\ext\dnsns.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\DVD Maker\PipeTran.dll.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\Java\jre7\bin\javacpl.exe.tmp	4d18444a4ba422403bd973bb406ebe90N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	4d18444a4ba422403bd973bb406ebe90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d18444a4ba422403bd973bb406ebe90N.exe

C:\Users\Admin\AppData\Local\Temp\4d18444a4ba422403bd973bb406ebe90N.exe
"C:\Users\Admin\AppData\Local\Temp\4d18444a4ba422403bd973bb406ebe90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
102KB

MD5
7359d6d8f1804a364f94042ae7fa00e9

SHA1
3b25d2c2ed72bcbaafa412e5ae526276dc5064a8

SHA256
a1daf76e8110bcf023553c8c61ced6633575a42b7d508b41430a6ba7d2386fd0

SHA512
b3ef818d6ee49c903ddae64d09cad940ab8c4f75fe3cc7674a03ea1e9a5ec2117e3f1289d88fe65b166b5e5841414993744556296bb2f2799a3e9e965dc48f55

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
111KB

MD5
5c00b1881483e12729f63730601fbc22

SHA1
10805629556353183dbff05a58b478d3c8e3b53b

SHA256
4b79c805ab2bb1d2d6c6572692a8f27c865174bf8bb16095e65de697cdd802a6

SHA512
2c4ca6d1bc0fc2871463ea6b5da1c4625de4b2077cd90d3a512ad416dea0697d7ac76ae3f65911e514378d9c947a83420dc41149be1b8310d1ecd43cf79f1be7

Download Submit