753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
Size

42KB
MD5

4db30db6d3d2f582d5743002e9072a68
SHA1

2e2b3a7d16a7d1dd69a90207dce33c5fdf61dae6
SHA256

753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5
SHA512

435d5abc7794250e3f72162255d9de56db80f850752241b9ab329d5e413f3230648e682eaf3cb65deb2750d51e69cb098541c9212c134603c0b9c56db2fd34ee
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLI3:W7ZppApBULcfpHLcfpyDP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3743) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_left.png.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\mip.exe.mui.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\VideoLAN\VLC\Documentation.url.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libsubsdelay_plugin.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_windy.png.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\main.css.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmicrodns_plugin.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\weather.css.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.swf.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\ConvertFromConvertTo.vdw.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Windows Journal\jnwdui.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe

C:\Users\Admin\AppData\Local\Temp\753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
"C:\Users\Admin\AppData\Local\Temp\753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
42KB

MD5
0a7034847375af420bab8318386cea07

SHA1
5bf9948ccfd6951078b7f6425278dcde182a8e23

SHA256
cd617010e83afc0db89238d9ee0bea9cc24c175791182f3ef1991e7c7e069140

SHA512
36c6681e10a73cfba44a85d8e23f56480fbb3e71db88232cd47cc02dd1128916f3aa8d36e7ab74df14bf224ed8d88394b5b2c9cd792300aa6f8324f354390938

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
40d9df1e9296a9815d0abb2aaf9ac5bd

SHA1
35be3faae5d195ca53455ac997114e98f68f1ba9

SHA256
8035ff71ca0cae2eb1ec05102fd7453d8c1047084438ea065d91878996626ca8

SHA512
c0fcea9c86df04047f346ea79f475e4dc9fcfa85cb3e58f0c9f0eaa6fa6f0f66198f447c04a0d1f00187875ca98720389b7d0dd42a2bede721f5779bfde9faef

Download Submit