a0d59f4029184571c794be645cb96dfc940c3a1cddc4bd83f6e9ca7feb1450fc

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13864096e495143282a2f9d44e708d00N.exe
Size

108KB
MD5

13864096e495143282a2f9d44e708d00
SHA1

b61f0710c90fa810b9ff60e1b8462e6be2641303
SHA256

a0d59f4029184571c794be645cb96dfc940c3a1cddc4bd83f6e9ca7feb1450fc
SHA512

14397143ba6de5dc8c58fe1a23220433c964ddd69dd371b0c9d385e707939275814c175d1ffb302784ca2659eb2e0a721795c1bad9248f72cc29627dcd80dc7c
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBT:PqFF2Ie+efsim2k

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2952) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Taipei.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jre7\bin\libxml2.dll.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Paris.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jre7\lib\ext\localedata.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	13864096e495143282a2f9d44e708d00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.tmp	13864096e495143282a2f9d44e708d00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13864096e495143282a2f9d44e708d00N.exe

C:\Users\Admin\AppData\Local\Temp\13864096e495143282a2f9d44e708d00N.exe
"C:\Users\Admin\AppData\Local\Temp\13864096e495143282a2f9d44e708d00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
108KB

MD5
7f428b5a829aeaf60456b64caa88e68d

SHA1
8f1d50750aef6fb8bdb4276255cb6cbd12ec4376

SHA256
40ff037143a8668005c4ed31dd6015b73825e147a6507075b4ab439d5bc2e94d

SHA512
179dec1b2b15f979d12cb873bd4ad77a44e6ff89269d233783353948127e747a81bfe3e02f68474b20bdcb5ae4db147addb1e6be4190e024ff1ad04d01cfa2eb

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
117KB

MD5
f14ffae6c23a384746043b07ca5fbdbd

SHA1
5192657face2b6697207d0fad0bb393fae802d29

SHA256
50eb28409627152d48eb094a38ae40bd9d00e818569fb0ede8b268e60feda740

SHA512
2f884c43e467a823d4ccaaa32c897ce11ecc3defa18ff2216eacdf1a99cc08f7cbbfef369b2e97ee05e58b0c3e78d9c94552dda3d1654d922afddde2af4d9e3e

Download Submit