12664f97c15e5defec036aaf9ea7655f2439a95ea181abeb16340b3e0ae97a75

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c26a9f12a25abec013564181066baef0N.exe
Size

47KB
MD5

c26a9f12a25abec013564181066baef0
SHA1

6c6608d6a64106e8e71f75c5ee13a7e2d183f7c7
SHA256

12664f97c15e5defec036aaf9ea7655f2439a95ea181abeb16340b3e0ae97a75
SHA512

966e88deaffeea1824db08f06ac0252febd9541df1812d22031a5d69b4f15cd6c60acc5d7acc829233c83b1efa817b3df92011a7cd8db6107ba9bb8ffab54fbc
SSDEEP

768:W7BlphA7pARFbhL801VvM801Vvv7cY6SpSo:W7ZhA7pApw03vR03v4Yd4o

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3273) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jre7\lib\security\trusted.libraries.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\vlc.mo.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jre7\bin\keytool.exe.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\CloseHide.lock.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chicago.tmp	c26a9f12a25abec013564181066baef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	c26a9f12a25abec013564181066baef0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c26a9f12a25abec013564181066baef0N.exe

C:\Users\Admin\AppData\Local\Temp\c26a9f12a25abec013564181066baef0N.exe
"C:\Users\Admin\AppData\Local\Temp\c26a9f12a25abec013564181066baef0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
47KB

MD5
f90770116bc7e4d8e572b4f89a8eb9cb

SHA1
25154137b13df8cf905898a01827be4236af6ce7

SHA256
7f859e8c91c0cf6aab1cebea35175e42db44874dc2f124dacf03b7eb586c95a0

SHA512
b795be1195ad5ea70bf28e331c5b665ab9fb7cddab0e8542a8fc3d71fea4718edb8aecee8d534edc6774d34b28855ea8e0be2c9b01733b023499dbf3db7aad05

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
83ecb3b1a42b8847f07430abbf881e6e

SHA1
8da816c90196e48a9ed9b6a56ed723285377c5f3

SHA256
7cbbac7c001577b49374f883ec09ffe3aa034914f9c7665e2bc4abfae5d78757

SHA512
3834663fac7c3a453b612feb4791f27e9bfedafe58e9132d207c93a38866f2afaa1300fc38f2ce7f4d53edfd90a98a80c9b7847951274c096a468a513a897fe7

Download Submit