ce195ced486637b9c058fbf1a8ccdf3189849d556c6c0ee6319629e211accc90

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04977d8f002efe5bd41927712007b650N.exe
Size

48KB
MD5

04977d8f002efe5bd41927712007b650
SHA1

b265ec2f4d314bb96ef75df169fcecab85ad9e94
SHA256

ce195ced486637b9c058fbf1a8ccdf3189849d556c6c0ee6319629e211accc90
SHA512

4c72d5d95439211b7b387cbf5ab39cf92af10dd7e733764f3c439c434e0c1507c7a8b1fc482ac77f7328d48f4d3bd595295e7b31301d8bf08844ec6d1238ac66
SSDEEP

1536:W7ZppApBULcfpHLcfpyDDnTxASYnTxASshJ6X:6pWpBwchcwDDnTxASYnTxASN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3168) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Microsoft Games\Chess\fr-FR\Chess.exe.mui.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\DVD Maker\OmdBase.dll.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Mozilla Firefox\update-settings.ini.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\view.html.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp	04977d8f002efe5bd41927712007b650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp	04977d8f002efe5bd41927712007b650N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04977d8f002efe5bd41927712007b650N.exe

C:\Users\Admin\AppData\Local\Temp\04977d8f002efe5bd41927712007b650N.exe
"C:\Users\Admin\AppData\Local\Temp\04977d8f002efe5bd41927712007b650N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
48KB

MD5
92a5f7ed167ea4597bb923921395a7a2

SHA1
ce7e00da2e13c7418fda9a93dfa2a2c73c8852f5

SHA256
bb069fa6b124628aff3fa0ac261f107c3d09c962120b2c3c5a25b17963fbf5bc

SHA512
2a0885b0be2a689f4068ba0d4d293ed01e75c0ba3ceb8aa35650750e729b0a6eee7845f283053ad8a422117aa4c8f21b1c0ab580e65fc93b15289efae5cfe6be

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
57KB

MD5
ee9d2a417daa5f60756ed4503d35b90f

SHA1
17a78154634406b70245608bfd87b642d56827f9

SHA256
5a4f42f1748c62e03f81a4ab37d23c943573fe23e5950424083f25cd6414b1ad

SHA512
dc4446f17f2caf13041ab4b8773bda6dd9212c59b93b9a61cdb1331b3ce4a1af65caf370c0fda63fb3d21e5e67da78f6dd5dec3da162fad4e22ba8a2178adafe

Download Submit