d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
Size

91KB
MD5

e6b71023deba5610474083c104e25121
SHA1

10d561bd955b2d5e29eaacdf5d1891217bb6cff3
SHA256

d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae
SHA512

469e0dff48471d77ef969bb24ed461d176cd413a1bfa6b1c6f8abad9038a0694a7f5a676aff6c83f723da658c2a4062ea2b238d447fa92a91c5b68d5d97d76bb
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKgg+EvBnHHwTVEvBnHHwTEwQ:69WpQE0zxg+TOwQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3448) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nipigon.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Defender\MpOAV.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Waitcursor.gif.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Journal\ja-JP\MSPVWCTL.DLL.mui.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\corner.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Mozilla Firefox\platform.ini.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Louisville.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Journal\it-IT\MSPVWCTL.DLL.mui.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jre7\bin\deploy.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_docked.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\icon.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Edmonton.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-right.png.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html.tmp	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe

C:\Users\Admin\AppData\Local\Temp\d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe
"C:\Users\Admin\AppData\Local\Temp\d65c497afe4a673292c8a5497b32368e96b2ddac06f7ee748107e991e2422fae.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
92KB

MD5
07dfca774298047d19127818557e697c

SHA1
0e7b530bc4ae841ac57b31c112d9dc4bb1d6bea7

SHA256
c7f3e6d7b779c3e523671a9165dbc501fca26da78b0e14151d31d5dbfbfbfe01

SHA512
7565fdcb8699b2b4dfbf420586aae2b170258e621363afa3e0ae3dc234ff68e7159c9cfc47c9a84e5e09af2958b211c458319893ff4616c8b2c962f9312a5040

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
101KB

MD5
66364f687ae42e559fd62da9bd70798c

SHA1
2225cbd3563da2ba42d7d34aaf776bffd346de65

SHA256
5372f946c186aa604744855e56c1b724c05b4155e734834ddc2fb9ca8e1725dc

SHA512
c830822c5e34aece733f962e77ab18819ed4b686fb80dfc728edc905df2b9b12fd580bd4822998500678c196894208be1088f87d8985ca44c3a0f0f128bf9191

Download Submit