8a283b2371e0a9bc77750cecf7a52da0f989671e111a3d4cdfaa876abc259a83

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f595cb4b509fc658ea57693e674a0cd0N.exe
Size

103KB
MD5

f595cb4b509fc658ea57693e674a0cd0
SHA1

becf34913e4cfad7a40b6dc7978b2d2f883b31ad
SHA256

8a283b2371e0a9bc77750cecf7a52da0f989671e111a3d4cdfaa876abc259a83
SHA512

297792d2558fcc528e28613706ba2b5004165d177f1ca2a4c6b23250e1b64f370d9df8234f65ac6b29e82efe8349bff4e614c5716e91856d44008e3c0e2ac990
SSDEEP

1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/8z3MLHsk:6DWpwE7oL2e+efZwZ08i8z3MLHsk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2939) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsdt.dll.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Selectors.Resources.dll.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jre7\bin\awt.dll.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Mozilla Firefox\postSigningData.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	f595cb4b509fc658ea57693e674a0cd0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f595cb4b509fc658ea57693e674a0cd0N.exe

C:\Users\Admin\AppData\Local\Temp\f595cb4b509fc658ea57693e674a0cd0N.exe
"C:\Users\Admin\AppData\Local\Temp\f595cb4b509fc658ea57693e674a0cd0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
103KB

MD5
a650b05cf28c69faa3864c2a47e07dba

SHA1
fba04a24c0bb051b0a8104fd15b89cb3afa73f92

SHA256
f7b454699bf80b601efbf6fbd3b5d9d2923f1cef61bb5760ccb751e8eaef2adf

SHA512
cadb0d868d91e67903e400cfde5e75a3a0f0ede6506043a4537ee9a5c1bdd1ea03ee9e531555be6b324417feade9ce13f657c17c12943c8e6f1413a593db0d0d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
112KB

MD5
b90fc6b52fd90f40ea40f3bdd778c6bd

SHA1
dc2ee0e5830c2845eec41c3123a6658ddb711113

SHA256
f3e538af9ef6325b459054d4c7c8690eed029fad698f48dd6510f64598f12280

SHA512
14593781274e73603368264e2cb9f3d47904cf5fa1cdaecaae879c8d81d8c10e81e4c41af1db35e158421239dc6dc11311de651b0456052889859b3f89bc1604

Download Submit