f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
Size

45KB
MD5

626f4e0fe30cd364860a26368d6cf46e
SHA1

5dd1be36fb14f4246548ddafa5a1198e08662ec7
SHA256

f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c
SHA512

16bb53a00e6c4d5bddacebd16133a81b92ee5e6e18c90898910cb0ca277988f28038c97f1bf412d9b91ff5b11e7eacbbe49f696130f379dd64fdab64fcef8792
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLmuH9uHU:W7ZppApBULcfpHLcfpyD9uH9uHU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3798) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jre7\bin\libxslt.dll.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\micaut.dll.mui.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\JoinAdd.m4a.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\cpu.css.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwgst.dll.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\com-sun-tools-visualvm-modules-startup.jar.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_rest.png.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_rest.png.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.3.2.jar.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODEXL.DLL.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Windows Journal\es-ES\JNTFiltr.dll.mui.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\4.png.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\Keywords.HxK.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Samarkand.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jre7\lib\jsse.jar.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\QRCode.pmp.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe

C:\Users\Admin\AppData\Local\Temp\f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe
"C:\Users\Admin\AppData\Local\Temp\f1cfdcc544279addfa773e88a58579d3b35399609848f68bad20f9e4fbbe7d0c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
45KB

MD5
f1365b416e0baeed5af507f4bf99d1ee

SHA1
365039cf9ee15451ae7cdd01f442fbe4b920c8ed

SHA256
e6dd6042fed0a94c849fab017d53e8300dc1a4db32f20db014ed395cb1825057

SHA512
b6103f2aec71e299a478edf5b3a616c2e9dac442588858a2f5b8d6e0d4a21d783a0001fe5feae895fc521adc22af47f8e1a877817bfe0052f5d6d8c920f966ac

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
ffb7864a25171f80b54e949c5c39294d

SHA1
305b1e6dd2822bc3ed4b00a3931475e1b783daba

SHA256
7fa6d3a436eaf3bbc53f8e59a554eb091ddd5dcd36c0aaaf084332b47454ed00

SHA512
3aafa71f220ec36d0d84472f998b3ca6398d8e65af14046ff57ee98240692276f40efb9738c0cb1309f8a03a3a6fcaa907d091c14e4f86b4f0fd15c1a6afc1a4

Download Submit