5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
Size

64KB
MD5

1151eeb0b6127be5739f96b907bc92aa
SHA1

5d356583a8387b6b023aef73c2749877f7d3d855
SHA256

5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9
SHA512

eadca165853acb5ff522be27c531c4cd2e64591ad827a7e903761c51f54ff36bf4b7c028d317f6e33eac4dd9e9719c3710ebca1d696203ad42ca235222bf3592
SSDEEP

1536:W7ZppApryb81KP2awclvmxaKP2awclvmxv:6pWpi8wP2awclvmxrP2awclvmxv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3528) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_pressed.png.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\slideshow_glass_frame.png.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Media Player\ja-JP\WMPSideShowGadget.exe.mui.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\localizedStrings.js.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Microsoft Games\More Games\it-IT\MoreGames.dll.mui.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\library.js.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\VideoLAN\VLC\axvlc.dll.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double.png.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\settings.html.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guayaquil.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Journal\it-IT\JNTFiltr.dll.mui.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_down.png.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_foggy.png.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\9.png.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.tmp	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe

C:\Users\Admin\AppData\Local\Temp\5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe
"C:\Users\Admin\AppData\Local\Temp\5137b070039f2800b0ab1d8d86ed9f5cec3eb4cd56b3eea46f5ba7a84abe2cc9.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
64KB

MD5
f80db07f2ec2214bcd9f31761e7dff69

SHA1
d2ae0d235f5fc1521d05f7facd3bb0cc638e31db

SHA256
4374f9a6c9abea90229d718d517c737d6431228de218727862843b98235f0e0e

SHA512
dbfc80e82fba0808ebcf87e7f950628ba37485b7596f0c5810dcf50c3f1566edd8ae2ae9fbf9641dcc825fe71db11ce9605b7bd57ea42decd97f1f483e1d094b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
73KB

MD5
55f9380e47feb84e7fae517e46cd279a

SHA1
f08a979ebe438489687f270155998cdb72b8d8c4

SHA256
048b5194062a730ae86d63ddf3d61c45d11b66d76199a28c74ac5ee57ec4030e

SHA512
22874683e124f40899e8f34d3c758b6a719643f997bcdc573e3714ef7257de01f1d4618ce5862a618adf5056a233fa21e2be6c75b0ae7cf155ed40eb80f6d1fa

Download Submit