59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
Size

53KB
MD5

1487ab65642effc26876ba9691d97ce7
SHA1

68b8dc1261315ce2d19c768adae7a0b53b7aa37c
SHA256

59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b
SHA512

c8707612323d9391eb86ba5563beba9e7eecd039c21b8905a7d5882727afe23b1c8c3d5e74739785e26392ef77b70d56f638fb365b0622c04dff26fe4a500f10
SSDEEP

768:W7BlpppARFbhbt7Y7wTCnB2ELEW0fZfIkE:W7ZppApgxkE

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3798) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\cpu.html.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmpnetwk.exe.mui.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\picturePuzzle.js.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\gadget.xml.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Journal\fr-FR\jnwmon.dll.mui.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\16-on-black.gif.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jre7\lib\psfont.properties.ja.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\gadget.xml.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\slideShow.js.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\FormatAdd.mpg.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_settings.png.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\6.png.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_left.png.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jre7\bin\awt.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe

C:\Users\Admin\AppData\Local\Temp\59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
"C:\Users\Admin\AppData\Local\Temp\59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
53KB

MD5
01b29097809103443dd5791385e4b627

SHA1
734f134b5763e76e304d2d75983ccc79da670305

SHA256
e68b1dff8509278775a9586ea1905de7ec91e6bd6d49968c2815a14cb0e77692

SHA512
05c923a290f05e3980e3f232a053e450edc1fcf046c5441dd2454621f82184636269ceb0242ac3d7d2ae5c1ac622df61ea3041354408ceac9f437cf85117dc15

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
f73a0ffdb97f9beac426a171810e9168

SHA1
dbd7330c4685dabf0e10084fdb2cbec0a812aeb7

SHA256
78c60bf18a835ec2e92ebcf1b7a2e2fda33dfbe27043e3d7400f73c00961c011

SHA512
94e3f44e1bc2e378e3c1a5023d8318ef39178522de6683b54fad755bf4161543863c1a894d8c231be7a5d83d68c46ef48395bc593e1328fa38621f38616280c7

Download Submit