18411ba519cbed985ca0e83e4368614c1e7189e62e59480e076a81e2eb443f5a

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7c5636edfc1bdaacf016c68c8030040N.exe
Size

46KB
MD5

a7c5636edfc1bdaacf016c68c8030040
SHA1

479d07a98eb8e1b7f7f1b0c1cb1d8876bb887d8c
SHA256

18411ba519cbed985ca0e83e4368614c1e7189e62e59480e076a81e2eb443f5a
SHA512

9a5885bc793f0965b9bcf5191b7e61ab38cfc6435b5a593b5739a45034e029c400188da7281194a5783203b2e4024cc7306621b635ec7799bc9469b792f4a798
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBN10wpAp/lvolGClvolGgFpdpllFE2lFENcjZjc:W7BlpppARFbhbt7Y7eDDESENF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3221) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent.ini.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\vlc.mo.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\New_York.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	a7c5636edfc1bdaacf016c68c8030040N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7c5636edfc1bdaacf016c68c8030040N.exe

C:\Users\Admin\AppData\Local\Temp\a7c5636edfc1bdaacf016c68c8030040N.exe
"C:\Users\Admin\AppData\Local\Temp\a7c5636edfc1bdaacf016c68c8030040N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
47KB

MD5
b26199ca29838b4c7ec9e3775471da61

SHA1
adcf42f0b0f530fe2e4e6b9573f7e8d2cc112594

SHA256
52848efcc2c0f1655736df863a0bc0c9a698956d171f61a24cd9e8d198f63782

SHA512
71a633954b78b86a16d3a2cf06ac2403306bcbee434a793be232464f0edaeba6f68b9fd5ac3cccd041127553fb2e2a8c87259b6489b478150516ef2cf83c4af1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
4ae542faf1c0f00fad978a56fa2a3ce2

SHA1
2c372ef72dd5493b064b72c3ff45d6201c38092c

SHA256
6c13cb17d88e2b1fafa5351de0ca07b3c2cfc25c22b9b88324b22a053f6b6c1d

SHA512
4d0a561f7e94f24b18c296b383a6537ca6e045824ea0b404c67a31fe5f5458493ba2d2679444da6f1f7755988620698030192437908b3b9c1dcd329601ee4d1f

Download Submit