06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
Size

63KB
MD5

c13db6465d884e4c842a3efd45898f21
SHA1

aeade95c05124b6bbe618f0987f23bc215843335
SHA256

06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444
SHA512

e5cfb485de51e7c5ac23713cbc2af1fa1b1585fb6b99b04e8758e77a02c5bb9e3e6e11c7c6c193a88a212e800bedf79f71ff87e6486e546c178e401accd69b2a
SSDEEP

1536:W7ZrpApojswv0EhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsF9:6rWpcsHEhLfyBtPf50FWkFpPDze/qFs9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3695) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\appletrailers.luac.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\cpu.html.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnetwk.exe.mui.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\clock.js.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\gadget.xml.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Windows Mail\de-DE\WinMail.exe.mui.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.properties.src.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-services.jar.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre7\bin\eula.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Mozilla Firefox\removed-files.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\gadget.xml.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe

C:\Users\Admin\AppData\Local\Temp\06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
"C:\Users\Admin\AppData\Local\Temp\06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
63KB

MD5
e1903f18b43076a728508def7882623d

SHA1
dbbaf64b20f691f13799d87b7fb536dc4199c3b4

SHA256
22ce88fe7ff24dd99651fe898a36afed79c8a7433baf1928183ab5509c898336

SHA512
6c1f8b2a6e4726743d6819df82eb219337f8318e087f1863d2e65dc771965a67205e0e45ded2674ad16a5770de9c87efa2d549774dd2193d8747f159ea8abd5c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
72KB

MD5
18a63dafadf2aa4d4f12c8ba34ebffb8

SHA1
7d7d8b3d3cf3b237993a10f514c09fd8a349c069

SHA256
64a0833ad0572c8dd80d81000a57e65d997b3137dc68856d245b577bca52b3be

SHA512
b03d988b285a734ba9ba65b0cd03481955f5c8400b21c38aad5887726b05177018f6c6918b0fad7004dbc6f1b2945f7430a1ec6aff6b36534f9dd5716bb13f65

Download Submit