85184260d43c7ee82b54a6c9d961ce6cf806e8d2e949cbc8dce694ae4c0df0dc

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd45a525cea0889f16526b0ce39b0480N.exe
Size

54KB
MD5

fd45a525cea0889f16526b0ce39b0480
SHA1

fb45dd0d006a0d248f904c12b7e9ebd62816d442
SHA256

85184260d43c7ee82b54a6c9d961ce6cf806e8d2e949cbc8dce694ae4c0df0dc
SHA512

ce2c9e46f3a09e5eccd9d1e9cb98e5b105a0d732bb3075016d9941deee8a0c1db4e273021856aa075cc2693063b65e407c640ec8cc550879f3bf3189211d6196
SSDEEP

768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJWX0kXX0krDzgpQZ+zzgpQZ+RElE+:W7ZppApkGpaI4RElE+

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3138) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jre7\bin\java.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Internet Explorer\Timeline.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmad_plugin.dll.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	fd45a525cea0889f16526b0ce39b0480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.tmp	fd45a525cea0889f16526b0ce39b0480N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd45a525cea0889f16526b0ce39b0480N.exe

C:\Users\Admin\AppData\Local\Temp\fd45a525cea0889f16526b0ce39b0480N.exe
"C:\Users\Admin\AppData\Local\Temp\fd45a525cea0889f16526b0ce39b0480N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
55KB

MD5
2e1676ff64f30f2f4d0a48256b8a5d87

SHA1
622ef8e09808d856d360e558f1928c012fafc0c6

SHA256
e9030272927a42880fcce6ea3c190715c0e8bdb40af2d1dc8794e1787914faae

SHA512
0056783d0f6461babf459475152aefcdc000c37c7cc17fa0ad434d94cf2aace0a5bf8cce21ceadd9ccbec1101d5f594e66eae89232ac52645c0ca515b3af6081

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
64KB

MD5
70546c3f57e81776ee061ffa4a218f45

SHA1
d8a288b43806e725b8571216f76f32ce2c9b10b0

SHA256
a949d321e46862f28ef81e7cdfc96ff386d7ea29149d219b57f3811e997b88a6

SHA512
d074ee323bc7c0d7481349f722f1f92e494641e86cc795db41fe26ca8c419257138e5e9f56a6d5a526f97e3de48fdecdaff031a15dcef49e39b21b907eddea7d

Download Submit