dc6a46d1a144e180def1de9bb86cde909788bef21ce4610bd3f44655776c8756

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

449e848180ae1c4f9de901a8937563f0N.exe
Size

48KB
MD5

449e848180ae1c4f9de901a8937563f0
SHA1

c556b480af866f0ab3faa09a1ff1029c2ff120fa
SHA256

dc6a46d1a144e180def1de9bb86cde909788bef21ce4610bd3f44655776c8756
SHA512

0b359a46ca03f44339abe6f625210d7e25e4492aced36fc171847f58b51a4f20740e3259ea11f9b2208a37e2b4b9afecf8c1310aab1a864c0bc941ad9f781780
SSDEEP

768:W7Blp2sspARFbh5YSfff9n1oXKCqzEIn1oXKCqzEmX4pNX4pd:W7Z2sspAp5YSfffkpupd

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jre7\bin\jsoundds.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Mozilla Firefox\IA2Marshal.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cuiaba.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jre7\release.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libau_plugin.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\ChkrRes.dll.mui.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server.jar.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp	449e848180ae1c4f9de901a8937563f0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp	449e848180ae1c4f9de901a8937563f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	449e848180ae1c4f9de901a8937563f0N.exe

C:\Users\Admin\AppData\Local\Temp\449e848180ae1c4f9de901a8937563f0N.exe
"C:\Users\Admin\AppData\Local\Temp\449e848180ae1c4f9de901a8937563f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
48KB

MD5
8dfbe1dc4ce1c9e82f2805c404d721a1

SHA1
9b11f881c90bf0160494c839100c934628cbe848

SHA256
355ae4716370bf4dfa1259175b2bd32a348d8caf6f59516dee5adaa850a45ce7

SHA512
bcfe695a91c9ba6b2fb9e55034f475384784c5ff0067616f6200a1cc056b1752b9d39922cae8b54f08fbf8467fb1107640db31d5c1011b020e53dc4342976e54

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
57KB

MD5
296e044dde14f3f7f5e400e428d90faa

SHA1
657d817e4d3ce1bf62481ddd55a83286a22cc550

SHA256
3bcc045bfcc3c2bc14fc55deec05764e4b8a98aadf4baf2faf0241313da3b6cc

SHA512
ab1232426ccda410a4673e56db6704cf98e820e5a465b473af0572d58855d7f327ebe9c2bd1fe32cacec82de73d7d30c484319d5729e845585b585c0523ef94f

Download Submit