a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
Size

82KB
MD5

2a860680b6a1717aaab17175c0e88a90
SHA1

f5bf5f082d16079fc74819820278d97997805beb
SHA256

a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33
SHA512

171b30f8d74d5da5120e49bcaef9490353b9685e031a5442183ca4a1945a58c8595a8249f8a05936b911675ee758694ac0ae024d15b4dbccf022dfc492d696b4
SSDEEP

768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORRey:W7ZDpApYbWj2WTWJe+e/qXhg+

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3699) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsdt.dll.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-actions.jar.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boise.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jre7\bin\jfxmedia.dll.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_m.png.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_cloudy.png.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jre7\bin\servertool.exe.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_down.png.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\slideShow.css.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\slideShow.html.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\init.js.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.tmp	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe

C:\Users\Admin\AppData\Local\Temp\a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe
"C:\Users\Admin\AppData\Local\Temp\a119ef4aed629886f79361d3752d4ac1c65d1b5adf7985fdd313d7f1ff625f33.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
82KB

MD5
452ec4119f947763429547bd4d38576c

SHA1
ac8072ce326449c757b6e3ebfb684fc7ad23a3cb

SHA256
4c44f0cf6c169d55493e2044346303a080d2fc98a02e3323fd5a5bf2a7c9803e

SHA512
344e3935a358e9aca6d8c186b7d96d5e5c3ab0102b97c6a5a866fe74281b0c430b932eac418ba6694ce97e281ac9a60d4091a0abaa5869be60fb0668d172e470

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
91KB

MD5
199fb61d7c5ae3131ac81f9ce7d4f7c9

SHA1
e4a24ec8712c9b692b9b9d909315ee17cb21c63a

SHA256
6677ea3fcab17aeda67612771675c3d5dd5f3578fc5f52f1f78aa8d08b6eee2d

SHA512
4f5eb89b6df21bd9a959c78ec3b56e22641b94b4b4c08c942eafc62aade6944de18f1207fe143eb113daeecd06b8e694df36ad029a300010e020b61dcd9fc22b

Download Submit