1d40a77f47423f64bb95b4a88de5a485d1f1bff325a521ce3f7e1b620a751887

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46315dc21511c941ef12217fbbe11b30N.exe
Size

128KB
MD5

46315dc21511c941ef12217fbbe11b30
SHA1

4fbc564d1bb86cf466d69d3666b210b8958fce33
SHA256

1d40a77f47423f64bb95b4a88de5a485d1f1bff325a521ce3f7e1b620a751887
SHA512

d13343073225a38f2e426869304fe2359d779af58b9bb98bc3a6048fc3b7a626f5654a980b1ef81c4816515c5017f87910d055ee8b435ec3ff52ea82d4095a25
SSDEEP

1536:W7ZNLpApCZrzLDPWGoPWGANdNykTBlv6Bll:6NLWpCZLBzHl2ll

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2857) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Araguaina.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2ssv.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre7\bin\javafx-iio.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre7\lib\ext\localedata.jar.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	46315dc21511c941ef12217fbbe11b30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46315dc21511c941ef12217fbbe11b30N.exe

C:\Users\Admin\AppData\Local\Temp\46315dc21511c941ef12217fbbe11b30N.exe
"C:\Users\Admin\AppData\Local\Temp\46315dc21511c941ef12217fbbe11b30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
129KB

MD5
8c0c0e70a29b2670b3c849dd1a9edde5

SHA1
7962d789ba6f1b0ca4cde8640d44f6d6cf1c3265

SHA256
65f6946e3c476d7502a74c98e89797539fd94a42e0971f80a2bd98e00d537dc7

SHA512
1ad7cc4c1df8b8be859b0b2ff432c37984ff39306c7156d142d47485dbda2c8432941c58a31be0ebc1a472d18ea4e51f5b4503b93391a14c68aee4972fb21321

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
138KB

MD5
4b179f71604617e50cdca6c5b8607920

SHA1
835e146f06cebdd09e59cadf337f408b20ffc647

SHA256
e5732ed95a4fd01452ae6d76560013eda884d4a7ecf7973d2bd774e5fc7b0ac6

SHA512
3db23c0084191207296a9ca152b2f81120611ad4aeac801bf38c8d18dee445c9e2207366b9f5be1592c86f8b60bb3b57ad02c44cc4e69c69de186cc5f1432e70

Download Submit