b8a5027c02c38dad021b7eeeec8d2225c0853a2c719564350227caf244b1830b

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a6ddbb6e060973beb7a6fc0df8abb940N.exe
Size

87KB
MD5

a6ddbb6e060973beb7a6fc0df8abb940
SHA1

0a1927e75c899d343a2ef5e61c0c76f9e8dda0f8
SHA256

b8a5027c02c38dad021b7eeeec8d2225c0853a2c719564350227caf244b1830b
SHA512

4bad6740000fa060b4871e7289c175a06ddd76fbe3e3a7c07762abefc7a4e99007b2447829bf269ca1891f8758e4dd4f5a733e486c2b9d97ae1014b35a619f7c
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYo:6e7WpMaxeb0CYJ97lEYNR73e+eGGP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3048) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Jamaica.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jre7\lib\tzmappings.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_es.properties.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository_1.2.100.v20131209-2144.jar.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nassau.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\VideoLAN\VLC\libvlc.dll.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jre7\LICENSE.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Dublin.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jre7\lib\zi\GMT.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tijuana.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.tmp	a6ddbb6e060973beb7a6fc0df8abb940N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6ddbb6e060973beb7a6fc0df8abb940N.exe

C:\Users\Admin\AppData\Local\Temp\a6ddbb6e060973beb7a6fc0df8abb940N.exe
"C:\Users\Admin\AppData\Local\Temp\a6ddbb6e060973beb7a6fc0df8abb940N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
87KB

MD5
07a769acc13ac3fd1b44db65afe32f59

SHA1
430de258e34666151044b396e88386c57588fc3a

SHA256
d09e1539b5fb066f3c413878af27f316796fe7c0b4a27afea8cf608cc47235b2

SHA512
515c22c92e41a26426cbe04d2a2b2102ccd1ecf0a7e1c61abb78115f954ba7267dfb86dd3d3278e095efe659fc7e8612fb2ea5b46c345f38c4b7566c0e4cf049

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
96KB

MD5
946dcad1d112b6d84f44932b13601861

SHA1
b2e208ed479f2b456b9fdeabab8e17526ba18f66

SHA256
c0178b6a4ccf31c53bb9ad476428cd939ef11a6c8c8aa27c2b21919f9701f363

SHA512
45dd6b22f8584794745943ce2958e2d87cbde56d9dd2968bec1f8bc1912247240e423e7529cdea3f8d5fb86ddea3fe8ac9e09aa3e1a395e558e7ebc34b2ae72d

Download Submit