581f85f14555701339a7fdf324450a72124d3f8c96d3283802a256e17883a929

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

594a07cf43794cb57526fa69571ad310N.exe
Size

79KB
MD5

594a07cf43794cb57526fa69571ad310
SHA1

30fab35081ed5f7a88bf0d8d629b51fab687f9d7
SHA256

581f85f14555701339a7fdf324450a72124d3f8c96d3283802a256e17883a929
SHA512

61f40e6b35c520a6f5a3cc7cdcbe0eab516f217d492eeba50cd51c7e3264ba52497bb4e7b7655460e9a76cdc8169af64393d71ed309d0f6c70ea66db3df5d0f4
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEq:/7ZQpApze+eJfFpsJOfFpsJ5DCj3Jj3f

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Microsoft Games\More Games\en-US\MoreGames.dll.mui.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jre7\bin\jp2launcher.exe.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jre7\bin\java.dll.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\New_York.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\CopyWait.pot.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Jamaica.tmp	594a07cf43794cb57526fa69571ad310N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	594a07cf43794cb57526fa69571ad310N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	594a07cf43794cb57526fa69571ad310N.exe

C:\Users\Admin\AppData\Local\Temp\594a07cf43794cb57526fa69571ad310N.exe
"C:\Users\Admin\AppData\Local\Temp\594a07cf43794cb57526fa69571ad310N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
80KB

MD5
4194e0f526fbed4627eada382709d00f

SHA1
e1d2ac30523b2354c15d59ed69c509a73de03d91

SHA256
c4820f1b09b95680f905d9bbba72404ec82a89df8de9030fd9650b81c84035fa

SHA512
871a43d3d7d483e9adc5731591d77a9737eebe9beb8035252be5c4467ea6063ebd45a559e79e3b94f8844062f9172afd741a755258e15986208edf64c22d238c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
89KB

MD5
cd2f488f413d2f472854d5dfa0329411

SHA1
f1aa75017b477cfaee8626380f04d219e4c3f637

SHA256
9683716d56e5a4d1d1b067a66ea0a5931608bbfdc3fb680c8545a83bea52e906

SHA512
23db340610d4c1f0c8298c9f884aa5e9ece2ac50d48de9df815516286c7a9c7073c7b8677c8d46e57927178c0d9ae17ff442fbf0da2824034c9cdf74c81a7c87

Download Submit
memory/2148-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download