d50f1d87c15478c4086ddaea93f2cfb288be2030d0a8c4a1b8a58c8d4acf8820

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe51ca70dfc0db1f486e9de94a2bb490N.exe
Size

43KB
MD5

fe51ca70dfc0db1f486e9de94a2bb490
SHA1

2f1ad7cba515b2eacbf4cc34cd4a2b8dccee0830
SHA256

d50f1d87c15478c4086ddaea93f2cfb288be2030d0a8c4a1b8a58c8d4acf8820
SHA512

dc874f113fc5f052357bf98d56be4970f58c8bb4f657d4610129407f462acee31674d5a3d37f77b41da2498cff17d1359db42e84867dc428f7636a0633f8f706
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c5gSC:W7ZhA7pApM21LOA1LOrtkpt6q

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3223) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Mozilla Firefox\vcruntime140.dll.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jre7\bin\jp2ssv.dll.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jre7\bin\sunec.dll.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jre7\lib\management\snmp.acl.template.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\SelectShow.mp2v.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tijuana.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.exe.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Mozilla Firefox\postSigningData.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk.tmp	fe51ca70dfc0db1f486e9de94a2bb490N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe51ca70dfc0db1f486e9de94a2bb490N.exe

C:\Users\Admin\AppData\Local\Temp\fe51ca70dfc0db1f486e9de94a2bb490N.exe
"C:\Users\Admin\AppData\Local\Temp\fe51ca70dfc0db1f486e9de94a2bb490N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
44KB

MD5
f16c8dd305eed7cf5f4ac1ea01f5a6c6

SHA1
60a7fa1bc271dafbe632aeafadadadd41794bf35

SHA256
d94ae491df5eba93157c28ba5e5d3de9f8753d27c227b99be654c8e846774192

SHA512
21649ca18ac085ae4bd8024114ca03fd920e5a948235362334bf87c2f993737aee8664ebbb1cc81bc03b63fe980bf96b8e024d6c79dec90f8a9b94cb8afff644

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
ebcbab40b7280b0141a96a38a2009ff7

SHA1
053a4393e062329f5b86b83df69275ee53c96009

SHA256
f85bd502d2667e98f3939884647691bf6a96f01c8231eaceb6b80b611e59b2e8

SHA512
ea89164c72f6c6d300b5a4fc409f3b049e238168558fc5a7fb1fdea40f34efacfd42fe96bbbc1101650b7a73d28a9f1dafecb1d081d7ed145f0b3abae8c53af0

Download Submit