0f0dee93fe91bbf3df4cead93412e0c4860770f7d7b831e669b96f0730a59cc7

Analysis

max time kernel
117s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

caa31ae2f84af4cf5cd4d3cee5f16420N.exe
Size

39KB
MD5

caa31ae2f84af4cf5cd4d3cee5f16420
SHA1

fba78846d97ed8ddf9e694ae3928bd60827795ff
SHA256

0f0dee93fe91bbf3df4cead93412e0c4860770f7d7b831e669b96f0730a59cc7
SHA512

a64533d6a3460a4f37b901588177cf84b5cefe8eca1f8abb93c520301b4336869353dc470d55215c16c060083e0ef8fbed4aa397284537ea9b3e139ee1982a05
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsStWyWL:W7ZhA7pApM21LOA1LOl6vSK

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3204) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\librist_plugin.dll.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Miquelon.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guayaquil.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Menominee.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Regina.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Mozilla Firefox\mozglue.dll.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.tmp	caa31ae2f84af4cf5cd4d3cee5f16420N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caa31ae2f84af4cf5cd4d3cee5f16420N.exe

C:\Users\Admin\AppData\Local\Temp\caa31ae2f84af4cf5cd4d3cee5f16420N.exe
"C:\Users\Admin\AppData\Local\Temp\caa31ae2f84af4cf5cd4d3cee5f16420N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
40KB

MD5
649e18450d5a829497eea7a9cb6a9b4d

SHA1
83853398df194d458392458ea94e067bdd5c1c3c

SHA256
814947e0f4bb8c69e0739f6a65bb292bfede4d70f3a5ad458d91a9db33ac6b86

SHA512
b545abc5849da7bf6e47fd3b4e5f8803e1035b601dd2b29c0afd6ba464a70140b7ef139a0fce6aae0c7626e3dd9d766a946c35d949974b7230ce7eaec2dfa84d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
49KB

MD5
24abc556904fdaa817204d00fdedec6d

SHA1
0295ba8ec52260c581561b8931c6ce1817ac0073

SHA256
90b7a77fb8b7d81b0da24d09941c74f25c91e6555ab6890254fe429cf1b6ab3b

SHA512
032c89c507bd42e4bad5e4c4460028079fd36f816fee07a030380c1af5d07f3d05a9e6db8e3003f1b520432456c36915121839fabe349218cc20c857fd109a0b

Download Submit