27c3c95fc5d5055acfaddbed8d2b9fbc4021d9d65a6652db597e8721b41a52dd

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5503b83f32202c8a976c12b899ced590N.exe
Size

40KB
MD5

5503b83f32202c8a976c12b899ced590
SHA1

0338d8a16c0c751da73fb8a4f2a325b5e8ff9e0a
SHA256

27c3c95fc5d5055acfaddbed8d2b9fbc4021d9d65a6652db597e8721b41a52dd
SHA512

df723b8e1d4eb8d1eba15f9313643a7977bd67118f8a6d2a95f7971bbbd851bdf2c08bd6f22dfc66ed1f298d19ee240e0ed41d00bf2ba5dc98e08e01470d73dc
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1Z:W7ZppApBULcfpHLcfpSo3fj

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3331) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Toronto.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.bfc.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jre7\bin\orbd.exe.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Martinique.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jre7\bin\jsound.dll.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-favorites.xml_hidden.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jre7\bin\kcms.dll.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vienna.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	5503b83f32202c8a976c12b899ced590N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll.tmp	5503b83f32202c8a976c12b899ced590N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5503b83f32202c8a976c12b899ced590N.exe

C:\Users\Admin\AppData\Local\Temp\5503b83f32202c8a976c12b899ced590N.exe
"C:\Users\Admin\AppData\Local\Temp\5503b83f32202c8a976c12b899ced590N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
41KB

MD5
dc244791938f61740df623a7580862db

SHA1
6a98a73b70a64aafbe8bd3202334985c15a7270c

SHA256
86ea451d75cba99376451c5d3a28ff728b91b74a86a0a490461277822fd58860

SHA512
4a6ba30b8f85b178001af263eca61ac2f891d37a3ec7d7044ad3476500fafffdfdb5f5e1ea3edfcb788fcfcf83bb253de15fa4ac85ecb7e507cac8aae0dafea0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
50KB

MD5
6e2c4e8f74c89426453c3d6daaec069c

SHA1
0e19f6c44fd0ab5e4b4c2b6f4aa99d94db6efa64

SHA256
83c9e91b17c95683a0d40d40f74b82322dc7b6efd72af580915011f2e6c67b83

SHA512
a87e5091ce72cc6970c8984c83d16ba73f9ce8c7d09479dc9d17e942b71b12788cae42ed3d2a46f78c6a64731a507aae5f5422a892ec66cc6943a9c1de10c531

Download Submit