ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
Size

59KB
MD5

8b3b8d3db46c3be1b1fd1c5f98343e54
SHA1

f8ec2b0fee85fc0bd5f11cdf8223b74c15b99446
SHA256

ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59
SHA512

19b9b72296cf62b5475a83f8df7ebe70b629badf9f2cde2d91ea02f46ded81fb6cf0c4e068663310d5a2a8a5f0c25066072d4f127eacfacc53b182572e63555e
SSDEEP

768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJcUYU30N7AVn0N7AVaYr2N2ZX+y:W7ZppApkxUYU30NQn0NQaYioH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3733) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromaprint_plugin.dll.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_record_plugin.dll.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Mozilla Firefox\installation_telemetry.json.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Microsoft Games\Hearts\Hearts.exe.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsepia_plugin.dll.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Tell_City.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\London.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_rainy.png.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_up.png.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\mip.exe.mui.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jre7\lib\zi\HST.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_es_plugin.dll.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\gadget.xml.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe

C:\Users\Admin\AppData\Local\Temp\ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe
"C:\Users\Admin\AppData\Local\Temp\ad501ea1a113b79f72afab7755d419665c04716a186f27ac163c4ddb4a9a5f59.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
59KB

MD5
9f434fc578d833aba73a37842b9c7a92

SHA1
a3b77a32bcf210d1c243d862233d935cfa43c2b3

SHA256
54fb3edd598b8deda298710277d80ad72ad62850d9304a81bab6daa41de5baa3

SHA512
f41aa34ab389114c24b5301837a7680541199eedf0fbb53a5f9d66298b108a89bce1dd0ea46595fee0017323ba4cafb547b3afd5882ee62c1d4cb3eadd678106

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
68KB

MD5
0d7e506e0ddce4bf5154c046d53bcc57

SHA1
239c101f658195d16c8ad7301ccfe80bc7c69d74

SHA256
7ede2e4c1c6c3323717a0ccb2f49f8945f2e1c9fff75b0cec3debe45d85c8e12

SHA512
074695a12c9009447ecbc1d1c669efb2b36defa0143b2eac270db90e84f0f019320f181f6364d95bbbd79463cd954e01110779927deb61bb56bb122805e2de77

Download Submit