b5a1646cbb6e63c718a3d121d5f91edd3ab2d8b1dcc90db290c48598c76cd960

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f042d56936a4acc61c02adf2e0d61d0N.exe
Size

42KB
MD5

5f042d56936a4acc61c02adf2e0d61d0
SHA1

d8e9bfcc5c955c82e7516120735c10cde755be90
SHA256

b5a1646cbb6e63c718a3d121d5f91edd3ab2d8b1dcc90db290c48598c76cd960
SHA512

399677a3ad6e89d9947f5e393b6fa384168b2aa2f2d7933270d794c1c7c6e2afc05708f4bf4b543f764ec7026bab0bb1c6515216a5b57bb0293c143386502cf0
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJL3:W7ZppApBULcfpHLcfpyDg

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3368) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santiago.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Mozilla Firefox\libEGL.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Mozilla Firefox\postSigningData.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jre7\bin\JdbcOdbc.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll.tmp	5f042d56936a4acc61c02adf2e0d61d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f042d56936a4acc61c02adf2e0d61d0N.exe

C:\Users\Admin\AppData\Local\Temp\5f042d56936a4acc61c02adf2e0d61d0N.exe
"C:\Users\Admin\AppData\Local\Temp\5f042d56936a4acc61c02adf2e0d61d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
42KB

MD5
764088b8dd34d23437ed40755b310496

SHA1
9f03a71f22e094fca7c7a1c29ed3aeccd0ecfcc3

SHA256
6a993e08d79f68359ecb517d384eb5b93669800b338398c61b0d9fa966aad90e

SHA512
37a856808a75327055b3394ec13bf2631b1ff09d9cc7a171916447e16f6e9d2487e3d050e3bc6c954b672351b546bb6c5e25d5100019f7d0e298807ea188008b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
4a447d5e89d9500e2c761bf54e15e6b1

SHA1
809300a3ad810b048df201e216cc24600be4d65d

SHA256
e574ab19cd4b79cfd5dd860e4935d808def7273c241773dcef982cf5c6147172

SHA512
665c0decaf84c706346acf995f6d1e8f39c83b84872ee5a53a947e148d3399405ab368ab9568f0f4e86a5c30600cbe35772e027ca9d943d40c2638a0698cb900

Download Submit