5cd5b4c5adbf2609bfdfab080911f3c44eb7b556f061f8142f2c979e76770405

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d4d3ace18261bc5acd02f27f6fa97470N.exe
Size

90KB
MD5

d4d3ace18261bc5acd02f27f6fa97470
SHA1

0826cf7520c8cbe1d1ead5057333271448e9a7aa
SHA256

5cd5b4c5adbf2609bfdfab080911f3c44eb7b556f061f8142f2c979e76770405
SHA512

44d359f6686a6dd7477291b89c72409a913ff719784ef910fe2218df5cf5eb114be1b4427ba76f1a543b5d4d95f93a6744f5600184c8849290cab887a6b6c008
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBK2LUf7XQex2L:69WpQE0zUzXA

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3095) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Net.Resources.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jre7\bin\awt.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Curacao.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\desktop.ini.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Mozilla Firefox\freebl3.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\VideoLAN\VLC\axvlc.dll.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp	d4d3ace18261bc5acd02f27f6fa97470N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4d3ace18261bc5acd02f27f6fa97470N.exe

C:\Users\Admin\AppData\Local\Temp\d4d3ace18261bc5acd02f27f6fa97470N.exe
"C:\Users\Admin\AppData\Local\Temp\d4d3ace18261bc5acd02f27f6fa97470N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
91KB

MD5
94f29b4ca87b446a60e93808dec53f9a

SHA1
60279fd48a5bae19a677d4014a98c52659dfe0d8

SHA256
9d47eff9c62644947f7a75f645329322f6e15e732c423d3cc942715a1652b021

SHA512
0088599bf3bd87c59f3565b8b7b367caf09c13ceef609fd7525ed79056d66efc528a4fe1ba78d600b9b7f8d959d65c1ee825e5f4173da7b01ba8c113f3dee0c1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
100KB

MD5
cbf09fe7250e2779d443c982cd2f1da9

SHA1
cfbecb42cb18842c34069ab64c4b4a3d93b70b25

SHA256
41808dd49cedb2358339bb36f729eafdd160e1ae140a276e988fc08140d8c3f9

SHA512
fc8d63d45b04423ce4f14debef0012377fe7d19159cbae092fa15cf74606cdbf20217e4bb0333e4cc3a93fbf24095e70cb442c51b8df6346b4eab38c4e8d67bd

Download Submit