9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
Size

91KB
MD5

57b3827220b46c470082cf9fdbba269e
SHA1

e98104e0551dabb4b6867ea503136d276ffa84aa
SHA256

9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89
SHA512

e35a78bbc4487fa0a2b75ae4cd1e6fa3b1abc613c484c898e0a32bf89745cfd3a2e11fd28e6575b2b921422a5ced97d6a8fa6c4e2acda7463c37d0efeb69b649
SSDEEP

1536:W7ZhA7dABJJZENTBAOvwdaERm3w0AXtXf:6e76BtE2aiUwlXtXf

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3510) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\service.js.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\ChkrRes.dll.mui.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows NT\TableTextService\es-ES\TableTextService.dll.mui.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Media Player\ja-JP\WMPSideShowGadget.exe.mui.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_m.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\settings.css.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\35.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libaudiobargraph_v_plugin.dll.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-dock.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\gadget.xml.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\4.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\gadget.xml.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\init.js.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe

C:\Users\Admin\AppData\Local\Temp\9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe
"C:\Users\Admin\AppData\Local\Temp\9748163358fc3143b83d0941e0bd64e8cc7524b1c880035d4848f935f1ca9c89.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
92KB

MD5
3eb436f611ac3e9006d1363c1f3fe80a

SHA1
80a06bf4f2b22c1c7b52506f559c3c14ca4cf783

SHA256
0153391ee4c8e4e30a05b13f1806aa967e90cb40871d37ea9e497e8de87698e8

SHA512
f190e4a899992799fc9d60dcba23e7d91e4e0885db68cc92b8a94a6f83ddf1420c0794eec7528d6ee965b3b45eb4160cc38b5e3434e7b5c74035ad7e90a9e999

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
100KB

MD5
2b835ad08054b2201ffcf759df82887c

SHA1
4621070ea7d7204a8b15e7033f478976e198f982

SHA256
87752e4c3bf277751917d1ab3e313cd57d8091a472e5a57ef1e6041de6039786

SHA512
ca738e6efd316471eb153f975c4a20f6b8a2ac9bc90a4581ad70ee86f975c59531f5ee4b4acde4a78c0da0016f40c88cc75bdb417ec603c4aaf85a2ca1caf16f

Download Submit