a8538ea2a15bd4d1cfb79fca5276e0a626e0f60cb3aa7f74e80a873d952aee29

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

885ab5572c54b317c511a233c685b1f0N.exe
Size

51KB
MD5

885ab5572c54b317c511a233c685b1f0
SHA1

aa1040d0b77732e2f4d29c8c25eed329809d3c8e
SHA256

a8538ea2a15bd4d1cfb79fca5276e0a626e0f60cb3aa7f74e80a873d952aee29
SHA512

9ad790702ba365e3a671feeb98a35b5a76b17011406a3fb4846c703dafd65bb12a69c873d7d9d0e951ccd1267d54f0dda4092e074484b1b14863cfe03fa59a1c
SSDEEP

768:W7BlphA7pARFbhL801VvM801VvcR2+lJtZ2+lJtSsOU6:W7ZhA7pApw03vR03vcltdtSsOU6

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3275) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jre7\bin\installer.dll.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Madrid.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	885ab5572c54b317c511a233c685b1f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.tmp	885ab5572c54b317c511a233c685b1f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	885ab5572c54b317c511a233c685b1f0N.exe

C:\Users\Admin\AppData\Local\Temp\885ab5572c54b317c511a233c685b1f0N.exe
"C:\Users\Admin\AppData\Local\Temp\885ab5572c54b317c511a233c685b1f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
51KB

MD5
3e1c2fa78674c26ac8657ef23039eae2

SHA1
f3861e8b1fb9552e141deda8ba13089c5288a451

SHA256
8edde67fb8f5ca0dfb6ebde546bf023510ed96a1ab8d3ee92fd0fba62e799db7

SHA512
899442580d999c91cc7c4f82758a2bbf462e5626de93b30025a21393734cd2c6e1d8a66e459c59d94994fb176d34d66c6f31bd4798f4bc7cd9ac62c454035a2e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
60KB

MD5
785434561e0e4781d77fe42bc7ec45fa

SHA1
39399b5be51502127258e01483f73ee78894ab1d

SHA256
374913f81a28c179678b8e8ffc3445bf77c2c1fb94b76ecd06783eba236430e0

SHA512
83d51059847a322e74f73139a9f6e6896000e7e632c4966f9556b80edf8e04bbfab557cdd3230a0daeb20df3c9e0fe0e0135a82fe05d832ea1f51c66ded2978a

Download Submit