6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
Size

44KB
MD5

0a9dc2623b1291231364cedf2a12fc5b
SHA1

18153ff10befeefc6e616c49153bc4f6a5b532e1
SHA256

6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e
SHA512

18975c7e2ecfcd01314c4fea24b73a4407073a309b26faca04cb57275559a5037b4fd56e8f5381d61c59e05864a759a56d3f0c2a3f8615da56bc7765fd121212
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxje6OMmy6OMm1i2:yBs7Br5xjL8AgA71Fbhv/Fzzwz4OY

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3846) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\settings.css.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\mip.exe.mui.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\ProPlusWW.XML.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\9.png.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner.png.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\flyout.css.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_hov.png.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up_BIDI.png.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\slideShow.js.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_sun.png.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\GIFIMP32.FLT.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Accra.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_pressed.png.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati.tmp	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe

C:\Users\Admin\AppData\Local\Temp\6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe
"C:\Users\Admin\AppData\Local\Temp\6ad048665dea9f619849a184c7b6ca586ab32624991c95a66bbe40a2f7da6e1e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
44KB

MD5
ba2990469204ef4e41a6256343d6d9aa

SHA1
142f64f716d60cc7584d77ceeaaa09b89b60eed7

SHA256
37684176ddda019e4b84bc3b8696c5ec21da1c6f57170da0733ba02f3dba4330

SHA512
31a7ebe4e63f1651792d940e7fbeb324fcc2faedc2dcfdb345271bcd7af0f0c461dbd6d2dae047a61f8bbc9287430933d2b4dd3115466c1cf74df35dc34d6de9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
ceb3762c7f779410992dce204ee4a7ac

SHA1
0514aa16174d0deaf0adb3a9ace062dddb6ead68

SHA256
df671dfc94885ff14233db595e1df8b95e1eee4cb8a250c7050cb1cf1cee0106

SHA512
8c95a9700a4b8a3f2cd73eb116dd851c8ce1dd43aa6870de3992d262710ac9aa84f947eab4b226bd5c870a8b9a0d36344b13f4ca5d07669d96c03b70ca05192c

Download Submit
memory/2720-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2720-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download