2285a5c256c0bb1d29606fabafa379a06bc8f5c8dfecabc2de1799b9612a6fc8

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

87a5b0d532a034c400e701650032e5b0N.exe
Size

87KB
MD5

87a5b0d532a034c400e701650032e5b0
SHA1

948b4c52856fc8405c17ac0e5ff9db47b8dda6c2
SHA256

2285a5c256c0bb1d29606fabafa379a06bc8f5c8dfecabc2de1799b9612a6fc8
SHA512

065d66679418259a43871d7a0e755c3aa52638993a4394ee1543bca903666594a758f56b5d050c6518e4f467a1a6ab40ab747c7de2750735b2606cdc145aaa48
SSDEEP

768:/7BlpQpARFbhiWb8naOnaBGNS10w2Yw23:/7ZQpAp/Eaiax1l

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3531) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\net.properties.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_bkg.png.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\gadget.xml.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Journal\en-US\MSPVWCTL.DLL.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\weather.js.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Perth.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\vlc.mo.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsepia_plugin.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextService.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer.png.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-left.png.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\picturePuzzle.js.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Microsoft Office\Office14\VISSHE.DLL.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseover.png.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\10.png.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Hermosillo.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST5EDT.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST.tmp	87a5b0d532a034c400e701650032e5b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	87a5b0d532a034c400e701650032e5b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87a5b0d532a034c400e701650032e5b0N.exe

C:\Users\Admin\AppData\Local\Temp\87a5b0d532a034c400e701650032e5b0N.exe
"C:\Users\Admin\AppData\Local\Temp\87a5b0d532a034c400e701650032e5b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
88KB

MD5
9a0234a4531f904c36eb6ace21b3a151

SHA1
36aa8bd6b49239c6bb177d3bd3a943222d4350c4

SHA256
4d555fc39e92ee06cdac350888b55c629086edbc31d4c4116e28501b22d9e9d0

SHA512
7f8e4763e5f13eed925cbd37e0447c1b3b826294402cad2d5db8ef0a7dd9be496ad83688b78add01156a4729daaef4de16f58cd3f9a485c7b7d88db8ac620173

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
96KB

MD5
0d486b49ae99e94b5f11de9e50a844ae

SHA1
3cb2cec22c5136598bf4595a205cbcf21191dda2

SHA256
cafd2c56c389b385e40a75f42db772c29618581fb8d8c4808a190f54f060bb5c

SHA512
bd500c9ba52641dbf3da0c2c09dcdcb3413af6625d1b567c383ec143d492e43a227cf76a8b2e02b2b9ebead0bbdd6b07e26965daec9453a3a66020da0bccfb83

Download Submit
memory/1192-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1192-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download