a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
Size

34KB
MD5

a5203bc53ee9410c141a20acb9438d0d
SHA1

d2d7c437adc62e4f5fe78210e53855cda72bc4b3
SHA256

a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802
SHA512

62ab3d6105647ee4c9985004b72036d0e46d0e8733b15f08012e4d4236b703e57f32685d3fd325671e15b4efc9d5b01213e6c00213158c7389be6a4646455181
SSDEEP

384:GBt7Br5xjL9A7AgA71FbhvnwR/s4Nkq81LOyq81LOUqKqh:W7BlphA7pARFbhM0Kkq81LOyq81LOP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3891) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\DATES.XML.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_read_plugin.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\gadget.xml.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Windows Journal\fr-FR\jnwmon.dll.mui.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santo_Domingo.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EURO\MSOEURO.DLL.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Windows Media Player\ja-JP\WMPDMC.exe.mui.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\OARPMANR.DLL.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kabul.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jre7\bin\orbd.exe.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\gadget.xml.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\abcpy.ini.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jre7\bin\deploy.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jre7\bin\fontmanager.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Windows Journal\JNTFiltr.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Windows NT\Accessories\wordpad.exe.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\gadget.xml.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\gadget.xml.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\NPSWF32.dll.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif.tmp	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe

C:\Users\Admin\AppData\Local\Temp\a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe
"C:\Users\Admin\AppData\Local\Temp\a54e737ee20bc24220c2b39c0ef496125dcaf04d8ef8e607ebfb66bfd131f802.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
35KB

MD5
0fef6abbab6e1adf8398d9a310fab71c

SHA1
9f8748d74abe95baac4686b8c187e4d445eaff94

SHA256
b9cfc92c9b09429b95ccce971a8b22e5971d8832c17d016aca4eec475ff6b0ca

SHA512
a2ccc843a568b96abfaea5ff418da49473879d17fc57fd9f7a697e89c96351adba5c715f34a29725dcd19dab008d7591296045d810f3f171d179f030f67743ef

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
43KB

MD5
6573e3d90229cf7ea06a5d72f0593d29

SHA1
ca3a67ab053d73d38f42b52617fb414a78c8b425

SHA256
052f79dc2cfc0e093e74f56b400bafa6a7417dd898be372e617e88b12d4d70dd

SHA512
a0609e72f0fee4e0ffd8342f911fffecf4d93c91861098a7b61d339bf118df4acd1ed4f22441b38fb2ea9a2d11a45cffc402e0463c74e581c0416441c462181b

Download Submit