21901f0d83c588057cc970a97facaa46064fc9e1070b96c34b2c217b6dc5fd58

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8dfeb891562f80ec706f1bf7f8ace10N.exe
Size

47KB
MD5

a8dfeb891562f80ec706f1bf7f8ace10
SHA1

dca2ef44fad2559bd0b218947f4d8c1b06ffbbac
SHA256

21901f0d83c588057cc970a97facaa46064fc9e1070b96c34b2c217b6dc5fd58
SHA512

d66ac98c654e448e1310024dee4abd23b818d8a0422242cdbae8732aeb0657f63c1e90b9efc4748f219d2eb48b8bfdf42f70c5a313a06080ae8977436fe2d128
SSDEEP

768:W7BlphA7pARFbhL801VvM801Vvv7+j9nT:W7ZhA7pApw03vR03vwnT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3289) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\mozglue.dll.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Chita.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.password.template.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Colombo.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jre7\lib\ext\meta-index.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmad_plugin.dll.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll.tmp	a8dfeb891562f80ec706f1bf7f8ace10N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8dfeb891562f80ec706f1bf7f8ace10N.exe

C:\Users\Admin\AppData\Local\Temp\a8dfeb891562f80ec706f1bf7f8ace10N.exe
"C:\Users\Admin\AppData\Local\Temp\a8dfeb891562f80ec706f1bf7f8ace10N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
48KB

MD5
568bf9e3721cddbffb3fc3fbacd2084f

SHA1
7a80bf6236a71e53760a60fcc2d41c8b9c65d5b2

SHA256
cfcc8f3102b953dc11ada2a62ec7cf581defcdac358c5f1bc900ffdb105dcec3

SHA512
2080a425d3b18372aaca63e01f6e26073d56d99ede6fbd11b24a526a736a3649c30664007967bbf500fc9beebe905f1495cbe4037ac522889b229472555e2242

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
57KB

MD5
7caa997567a938431ab183b536f42194

SHA1
eb3541603410d033c3c87c3eb2ac86c732929692

SHA256
7113cbfc7ccfcef2fe309cf1096956175c58b81bb6c86cce3aa7f2c221bcc669

SHA512
42a7212cc550e323a9a1b21c378a2c16aba275adc9d3c3a5fdb464cb9102fa008acf954573f56e065f99dfcafaeceed01a7672f6eb82b2a51b5cc21046e86f05

Download Submit