1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640

Analysis

max time kernel
150s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
Size

42KB
MD5

b75ed075f1449409a7ff5cf3044a5fe1
SHA1

535dddffb5b2c429963d0040cb5ee8225ceb763b
SHA256

1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640
SHA512

7dc92977706049c04277c70765384042cf5e890b2cb9bcc65ca6b9066f1906bc8ba21f1b521577c67172c2146b4825f39f423ea547f29c2471559d5c813b0532
SSDEEP

384:yBs7Br5xjL8AgA71FbhvBfepj3cfepj3KtLJilqGelqGk:/7BlpQpARFbhq1KtGFGk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1112) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chihuahua.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Pipeline.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DebugClear.ex_.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe

C:\Users\Admin\AppData\Local\Temp\1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
"C:\Users\Admin\AppData\Local\Temp\1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
43KB

MD5
5dde10763fa8221f308d2295e1360841

SHA1
7277fa94f02a010069074bd31144fbb0ead13308

SHA256
b738e90d49d991888d04fa622bf309b4f515fb513f680b9086c1ee8e200c7c38

SHA512
25ffcc183f4fbf84db58d692e2f95c488dadedc66d7eaac3ebf4bcd9b5f47c50c80c6f26ca2049fa5176634b00e818e1ba73e6aeb5d167039b7878fb3dd97640

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
9b85a01bd071275ebba25b283647102a

SHA1
12c15fe2795476a5d580c532c26e1377878f9f86

SHA256
018f9a3d8242ae35fedd2d31137bf7ea3738b8a0b0f3d5f57c9cea05ee28ecb0

SHA512
d42fc06d4f79af8471cfcdb0b1b1a204d326ee9001294ac361074e10165306424c7644f8964b754236cd659cf2925437aa890e4061b67f401691e88f2e073fa3

Download Submit
memory/2488-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2488-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download