1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
Size

36KB
MD5

a708f35d7b2ba0201fea61c93fba9bd1
SHA1

41a3fd42e1fd1e69988fc163ba4c28e9c580c243
SHA256

1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a
SHA512

9b1da750530be910fb45ea92f0a3d86022d7a4f84dab4fa06c8617785b9265e18ce247a04d1a1fcbdbecb2d8b4fa87ae1691f76f508a46599c9d1f7b2721e3fa
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHhpqW7U7OB9N73t9N7M:yBs7Br5xjL8AgA71Fbhvszwu9NDt9NDc

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3982) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libgme_plugin.dll.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\gadget.xml.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\PortalConnect.dll.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\THMBNAIL.PNG.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\library.js.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\gadget.xml.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\micaut.dll.mui.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Windows Sidebar\ja-JP\sbdrop.dll.mui.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MUOPTIN.DLL.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\THMBNAIL.PNG.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\33.png.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\DVD Maker\OmdBase.dll.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\PREVIEW.GIF.tmp	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe

C:\Users\Admin\AppData\Local\Temp\1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
"C:\Users\Admin\AppData\Local\Temp\1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
37KB

MD5
d5870ff7914ef58e434ee029c234bd55

SHA1
54c107f9efe05ae572cbc36924a35bd8ee4ede67

SHA256
5c42f3d6958e400c48165065ead51e806a3b98f9466ea237ccd3e9d316572e9f

SHA512
6ea077087002f0fa208590457323c5865b2e9c0cf4d50cdd9bbb24c1c0a3ee96d1b227b1433ccc753ef29ca7ebf7beb0b7c08284252fc1294e7e413fd752afec

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
45KB

MD5
14d2e5ac8322092bed16879ddea23d1c

SHA1
06df384e0fdc343bcf1198cf120d80af1d939842

SHA256
3ba4ba3189279caa0a3815bf0a2b8b78080e5324f1959353e23721035afeafa4

SHA512
1ed89b786477c0481910f20bdf31542e126a045d97c79336c5f4e3bc3997c0fe67178f89d27b43047a12128e8023a46b41987d0eb79ec9e47077364764c371f7

Download Submit
memory/1244-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1244-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download