dbd6a8cded4e1c377770f79a34a43f06a4c3a1e873297d841fb22b58ab967092

Analysis

max time kernel
150s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
Size

49KB
MD5

5095fd55dbb1d0e33307da678eef9670
SHA1

c786add4a0e645b37480d58f10542d63afe87d4b
SHA256

dbd6a8cded4e1c377770f79a34a43f06a4c3a1e873297d841fb22b58ab967092
SHA512

889e5d143a07cb11ed38237bbd0364157f3b6bb64a87d56fbd3f0c87552d57a7c804eecafbca1c7350a61d0cba1b17f0d80fd1b0d37d33c890f897f13ec1f0a1
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLY2kPWG3PWGD:W7ZppApBULcfpHLcfpyDf2kPWG3PWGD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3140) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\America\Belize.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Godthab.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-loaders.jar.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jre7\release.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jre7\bin\jawt.dll.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
File created	C:\Program Files\Microsoft Games\Mahjong\de-DE\Mahjong.exe.mui.tmp	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe

C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_5095fd55dbb1d0e33307da678eef9670.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
49KB

MD5
fcfa10a0f6f2eb6c5e04f19bc1a451ae

SHA1
ac703a8ba1f4b6859321cf165e51b026c8470095

SHA256
0c456b5a04f7920e90c18d4a0c90c85060e98d09f882df5e3c096bd29a135cd8

SHA512
24a90af5ddc752b85acc2e88cb74c43cb210acdf10cc603b48cc123c2e0d09fa1f9b5ef3a063df4d5b31a1361e592bbc85f5844d830e87cea832adb04c6797a0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
740c8011764aa7b6cb27a4a267324218

SHA1
e0837a69e664f9efcf92f6bbfa0074a01885c247

SHA256
c16b0288f436c24459d81737584ffdd400ce38b75796cd04739d25824e0088d2

SHA512
8dc8c731ff5125a8fb11881bc5d616a7a070dd6e3c2193f7ac36af5250803c514d7bdd83b24d70c0abdb87ff6b180f6811c82e30288319f3990284af36b5854a

Download Submit