5a927c0cbe7aefb57e8c3c5390af2492db6c8fbc14616f8e394dd90bdc900ad8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a43b8fcbe0e2114cb97d0499f531d30N.exe
Size

45KB
MD5

4a43b8fcbe0e2114cb97d0499f531d30
SHA1

2e928d0c038f9770ce851067691c8e9d32fdd8dc
SHA256

5a927c0cbe7aefb57e8c3c5390af2492db6c8fbc14616f8e394dd90bdc900ad8
SHA512

28cd216ec04161ae1b6bc0ae5a26da39e8c1ecbc2b7584462fcfc217c52dac7a18bbabd20e8195e497f19ac2a3aa6c4327222c09bf5fa92d8c559eaec4a5ae43
SSDEEP

384:GBt7Br5xjLdbAAgA71FbhvU8g0U0fLMzyKbNzzyKbNWkq3DLXakq3DLXOIwX4Iw5:W7Blp+pARFbhBgnKLMWK9WKD2N2lWrWp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3166) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\DVD Maker\Eurosti.TTF.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\vlc.mo.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.ini.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cancun.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\HST.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.sig.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	4a43b8fcbe0e2114cb97d0499f531d30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4a43b8fcbe0e2114cb97d0499f531d30N.exe

C:\Users\Admin\AppData\Local\Temp\4a43b8fcbe0e2114cb97d0499f531d30N.exe
"C:\Users\Admin\AppData\Local\Temp\4a43b8fcbe0e2114cb97d0499f531d30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
45KB

MD5
9baf37bcb34c5d222ff5ddc2bdda9793

SHA1
2a7f9cc864451b5750cc67047291960aee2eff66

SHA256
6d9795ce319bf9aa0083e0ee9df0545e480819403ccb88f9c70d5c2d356255b5

SHA512
31714dbf7b7bbe3f8f6fd54892c98877263cf0b33845ea8f117d63ab66020a88f279849182219621ed6c8b4624df310545657c6126e7c97e0683549e392e1629

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
4fa43d500e11558ae6aeb0303e8e044c

SHA1
98b901696869c9d5f76f53d542afa833f1f277b7

SHA256
43dd214da14d7a9d97ccfa98919f7f0689d9fb189f123a8afb23bba3433df510

SHA512
1a97ad024484e88148adf0d345c4fe68a93504235ca7085a201fd30c41889390ab08d147efa9d7704312264e65b150dceaf7db6e93f4a844d87b28bbf059d6d0

Download Submit