2c32a0ac134ec6f21652f34ffdb32c82ffff6c8e5ee43c584f524e8152e447b8

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5ade10f8bd44bbee63d8f074b037eb0N.exe
Size

132KB
MD5

a5ade10f8bd44bbee63d8f074b037eb0
SHA1

57d6fda97c745f6f15c3226aa825c7058150b84e
SHA256

2c32a0ac134ec6f21652f34ffdb32c82ffff6c8e5ee43c584f524e8152e447b8
SHA512

d1a1d58e40e4eb1ae96ac0f89af3b601680d5787bf1118af8db0d54c96f95d4728ca00472ff3547239925a17dad2aee1df8f7d7cd354da18dd6edf93c1f7719f
SSDEEP

1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8zxY55TWn1++PJHJXA/OsIZfzc3/Q8zxY5x:6e76mQSox59QSox5mAB

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2840) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boise.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santiago.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsFormsIntegration.resources.dll.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\bin\jdwp.dll.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin.tmp	a5ade10f8bd44bbee63d8f074b037eb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5ade10f8bd44bbee63d8f074b037eb0N.exe

C:\Users\Admin\AppData\Local\Temp\a5ade10f8bd44bbee63d8f074b037eb0N.exe
"C:\Users\Admin\AppData\Local\Temp\a5ade10f8bd44bbee63d8f074b037eb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
132KB

MD5
00694f36cfd6b5fa6d543c4ea1b20c85

SHA1
c531743fddbb7110e91701bad9e5b31b2a7952a6

SHA256
53072aaa12ef372be42ae0efd1dc22cf003789fbf59c3de2e104e3e5b11439b7

SHA512
b50f526af681cada0e05a8ad678cd98a33759c28c563e4b435d7808d0f242f15612cca43f9b6288d10d45dd99a6f7a98f031ad8fc11a915e2289876489eb53c5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
141KB

MD5
bfe3e845ec38bd7ee30810aae17dcb6d

SHA1
dcf8c20faf330ce5fb851ccaf7311fd710510c92

SHA256
592e917b16d88412009079d82aa4338dc17b3390eea1f76f9aaa810f236ada8b

SHA512
9d818948bf230fc8352c57fc4ddfe027fb96acce3c1f99a1fcebed489fc124fd0e30373681b0a04ff17fa6dff885bd5ec30f6e702767b849b4704c183e152f6e

Download Submit