b8fcd47265baf17b7c0e2122357fd05a864ee8899ba40a209cbdfa7608f23b3e

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
Size

53KB
MD5

a4353e032e3bd8ecf931fc6f44fb4cd0
SHA1

22d353887b49ce65b6e3ed79c518a3a72a6a5fa3
SHA256

b8fcd47265baf17b7c0e2122357fd05a864ee8899ba40a209cbdfa7608f23b3e
SHA512

31ad00d662c56feaf7f115dec1044f1193ec57d88b79a326dc2e79b351b14d69ab85369e0355ce577ff75569e0a8c3cbe13fd53241268ea6de12a35695e2deef
SSDEEP

768:W7BlphA7pARFbhL801VvM801VvcR2+lJtZ2+lJtSsZefn6dZEZd:W7ZhA7pApw03vR03vcltdtSsYfn6m

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3208) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Microsoft Games\More Games\en-US\MoreGames.dll.mui.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jre7\bin\jli.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\com-sun-tools-visualvm-modules-startup.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Mozilla Firefox\mozglue.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh87.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.tmp	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4353e032e3bd8ecf931fc6f44fb4cd0N.exe

C:\Users\Admin\AppData\Local\Temp\a4353e032e3bd8ecf931fc6f44fb4cd0N.exe
"C:\Users\Admin\AppData\Local\Temp\a4353e032e3bd8ecf931fc6f44fb4cd0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
53KB

MD5
ef9337c3f112785e5ed526e3f1ef52f4

SHA1
1d63b918273a425b3bf663f869a0e6b0fc0d9e5c

SHA256
e16c81756f6282f3e10474f247bea72d063336a7eb411553065bd2f46ef850d1

SHA512
882ab59a070f6a240fb82e4efb717b08560f05c22d304def0982e19e49f63fbb6389741be574c83fb43f586bf2de3b7151e98c29130b52192574646a96995288

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
2fc6e1a4ed8995153f30a593ad406501

SHA1
195b4a42f04197279d0ddd7b34143cbec7d993b8

SHA256
bec88bf5e870ed4a5ad24bdde51e3c1cba9285b51a7b6840cfa5016963a92321

SHA512
cf467ad5442b51c9af8153a1e124e7d2c54a7cdd45daee56d1bf90944721ec04a4cf53e5599efeb6df4f7df5567d7495e940a40165597009b30c447390615e7c

Download Submit