f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
Size

96KB
MD5

ae330108d1571bf0053af3d14dfd0f13
SHA1

4acfb3e2c6b2835f55c0fca0633f8feaee72a1ac
SHA256

f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633
SHA512

0b64fdb1da68b33cf84befce55081779d1e41c0c678b7ba06ef2352c964c1598689012d73480e6cc0e26abfddff52b01b055d9ae50fa9cda893d6c74333bd4c4
SSDEEP

768:W7BlpppARFbh2VXVXiEtL1UairBanib+UairBanibUX4pNX4pi:W7ZppApUFptL1UaiN+UaiNTpupi

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3462) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jre7\bin\unpack200.exe.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseout.png.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Mail\msoe.dll.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libpva_plugin.dll.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_few-showers.png.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jre7\bin\jfr.dll.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot.png.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\gadget.xml.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.RunTime.Serialization.Resources.dll.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Perth.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\settings.js.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Media Player\de-DE\WMPSideShowGadget.exe.mui.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\localizedSettings.css.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libglspectrum_plugin.dll.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\main_background.png.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_bottom.png.tmp	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe

C:\Users\Admin\AppData\Local\Temp\f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe
"C:\Users\Admin\AppData\Local\Temp\f9cad3c626f65c55f24a151bc4ccaa4a35e29c605eded3d66fdc9fefaa06c633.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
96KB

MD5
ce6c91d7578f5526c7455f7130a5f186

SHA1
599e4ce2c14f7f7bc6a9dadc6282b99d37c5e4a5

SHA256
5032dbad870be2dfb985f1f7f7702a61347639ad38fb39357674fde931a2cbeb

SHA512
9a9eeef3d83d95b3e0dd2ca075b2349228641671a117e435b3afbc4828222963ad4092c1903aa5f7f6a44b5946ba843598e89f2ebd7b8b7542cf91f3d8deb8b8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
105KB

MD5
9007e4347cc8b88994cd25f7a9ec50f6

SHA1
29f53f5ed6268f7032c765ed68b8db84b2818a9d

SHA256
9f1280cbe2597506f2f3a7762d2a4ac7dcf943f4f4e672adddeb385245f75f74

SHA512
330b61f38e5912272262811fd10c470a0af9c593a838b467d53f4cd74a8cb08333de969a6a46b02a08abc93daa86eda1fd92294527e9bd4506bb1afe0a9b1512

Download Submit