ec6082ab581498db0c921c6fe43c625b9d8a66869a6f3e42e25b7d45bd5da990

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

954ca6466028eca8d80e7b2ee1c85e60N.exe
Size

621KB
MD5

954ca6466028eca8d80e7b2ee1c85e60
SHA1

ecfe9019cfc51478640ca570f575c56e3e986cec
SHA256

ec6082ab581498db0c921c6fe43c625b9d8a66869a6f3e42e25b7d45bd5da990
SHA512

d1b3077385fc615b93f629d069859c25f6a23d2f570e280c0ece6d73c794cf0be6d3d93292973feb74a3ce4c9dbb85aa6a7855fc85e282ae65aab94d002b8477
SSDEEP

12288:Ck2ZkNvUKvWAWmIJY/83gai1hr/+IRdyC3wy7c6V0wR:CvumKDs4801RIC3f7c6V0w

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1093) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\fieldswitch.ax.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\offset.ax.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Taipei.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp	954ca6466028eca8d80e7b2ee1c85e60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	954ca6466028eca8d80e7b2ee1c85e60N.exe

C:\Users\Admin\AppData\Local\Temp\954ca6466028eca8d80e7b2ee1c85e60N.exe
"C:\Users\Admin\AppData\Local\Temp\954ca6466028eca8d80e7b2ee1c85e60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
621KB

MD5
12aaefbe1e4f7f43d9d0e8d4e5196866

SHA1
0153371038f2e23fdf84a3c953e30448637c7860

SHA256
8ad6245768fcbfd065212769271249e404d09dc650aba62756bdd058564c2474

SHA512
648ffba6ad7b63a0c5faac22c2ee3eb30afa67c4cd8719a23a88b5df1b3a582b2910c0fdd0948e87d60f3a9601c4a511cd94f874a59dce4588736c86c698a727

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
630KB

MD5
cba0854e1c6dbd5aa804f5c3e5e44681

SHA1
a3f42705a784acda1f80f264f86c1f2027ac1e91

SHA256
cafb8c88098b8a3fe25ff1f1df209b4db15a83e56dc7c69f8bb042b5b46e5020

SHA512
5ac6540760fba2602bd579c5483d995d1af2010fcb1ec747eafe22870e5170db7365290361a28e2bd65801ae3c8e02139d6b3b7c39efd59027c2cebdc3f3e483

Download Submit