8b803ba1d52d804347aca3472752e54600020acb19de37b60fb20639f4bd9968

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a9a205c8b5eca66bdb26e3460cffdd0N.exe
Size

43KB
MD5

1a9a205c8b5eca66bdb26e3460cffdd0
SHA1

759c1647525a55f1263f6c7d55b1056f7974503c
SHA256

8b803ba1d52d804347aca3472752e54600020acb19de37b60fb20639f4bd9968
SHA512

50d5144d0175792c346da419d2f618bf3b6f6705294a39925550d7d084680af5e94ab7446b0b08a22dbcb6c5e884675d6a3125dfe6bc1e2bc34748f3cab022f7
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LObC8p8f+ui:W7ZhA7pApM21LOA1LO7

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3185) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Tell_City.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Halifax.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\main.css.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\bin\unpack.dll.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta.tmp	1a9a205c8b5eca66bdb26e3460cffdd0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a9a205c8b5eca66bdb26e3460cffdd0N.exe

C:\Users\Admin\AppData\Local\Temp\1a9a205c8b5eca66bdb26e3460cffdd0N.exe
"C:\Users\Admin\AppData\Local\Temp\1a9a205c8b5eca66bdb26e3460cffdd0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
43KB

MD5
8c456c13a4b64567b92684e2673eff92

SHA1
42114e24bc998373191fbb2c721d55b6cacdf922

SHA256
df5fcc8458d59996404c3bce288f3d8afba0585793a26a272e4c192e7fced340

SHA512
bde68dc254357d6992d7e9232f329917ffbeaee2e4f680a4353fa5095db8bbb69db33dd3facd7cf0af1500df0284e24a0110157728cf915426a07c1dcbc701c4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
52KB

MD5
fc7119b6e5c332e59ca7ebdd0ef5d19a

SHA1
ccef4ce45357d87923d30805f75c467217ccf7c9

SHA256
caea3b968690fd628b4296c11e1228fae36448b76c396ad0312e74e45f203437

SHA512
f5716a2c273cd447b0e9c558946eab7854c9b8b170590033093972e73cded9c53dba556a7d6d017c34b05363977271b5328dd7544aed42363f782df39165b156

Download Submit