0b005187e78bbde06493c3c9ff1e250e12d71b8e92e761780d2e16154af9b77d

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1abd70bbc43499f91e4aa0c7c2204df0N.exe
Size

41KB
MD5

1abd70bbc43499f91e4aa0c7c2204df0
SHA1

dceb3d1ab819c1dc81a895aaa4ecaa8d30528e6d
SHA256

0b005187e78bbde06493c3c9ff1e250e12d71b8e92e761780d2e16154af9b77d
SHA512

99ddf242afe7cc17b09e992ae5df2ce45a4572fe2e5adeeb139d3cb1a8b33d6aef34d493fb3f8571f6ce781fa4738caad8883822724404fd6bce5fd7ca5ccca4
SSDEEP

384:GBt7Br5xjL7lAgA71Fbhvt3e4S04Sw7V0cZ7V0c9:W7Blp9pARFbhs101kVFtVF9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3451) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Windows Defender\MpSvc.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Menominee.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jre7\bin\jp2launcher.exe.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jre7\lib\javaws.jar.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Perth.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\VideoLAN\VLC\AUTHORS.txt.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1abd70bbc43499f91e4aa0c7c2204df0N.exe

C:\Users\Admin\AppData\Local\Temp\1abd70bbc43499f91e4aa0c7c2204df0N.exe
"C:\Users\Admin\AppData\Local\Temp\1abd70bbc43499f91e4aa0c7c2204df0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
42KB

MD5
47acc728c5a6f21691018b696541d99f

SHA1
0387ac1b542e2439c5aa123a02a14540ac6680c1

SHA256
90b132d7e48257bef5687cdd0cc874821f1a541d9f09130a7cb22a679acb7b5f

SHA512
1a9148152b4792fecd7affb4ce90932c790dfd1938054a5af7a856102e535f5b64ccd2f5337cc5eaef9c17fbf068c14ae6bfa89908891f62663957bb6a608762

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
247ab38c995a12d43e842619d99546e6

SHA1
5bc12cb0eb15aa4030e5cf2312dc6d44297a1857

SHA256
2ce5e9ad0ba1915eb641dc4de87913cbbef7d45c6e29e012f220e7602247351b

SHA512
37ac9627945881a03f8e96ef82135a091fa8c91bfb2320d43dd4fd21b0ef7f7a7aad3997c80bfefe8a09e0282e2ea6efda9f950f1ddb141d353d2f3dded137f6

Download Submit