56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
Size

34KB
MD5

b8d96b9e53532b931676505d77f1e9c0
SHA1

d41718a3dba3f939a2061d343e552d791b79d80b
SHA256

56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45
SHA512

229a48e3354432acf49b665d6f21fc7b450d8891c1bfebb550a750a58eada886a0f463e1ae2cf671a93b7d7b662b1322c01c406a18436f26346da38a214c15ed
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lt:W7ZhA7pApM21LOA1LOl6o

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3343) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\.lastModified.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libprefetch_plugin.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Engine.resources.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\splash.gif.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
File created	C:\Program Files\Java\jre7\lib\plugin.jar.tmp	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe

C:\Users\Admin\AppData\Local\Temp\56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe
"C:\Users\Admin\AppData\Local\Temp\56a1d7a202834638b596b5bcca4843a794d888c3d81799f66ce41eadeafe2d45N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
35KB

MD5
ea197c24d1609a0018af2cec9355aefc

SHA1
7cb6ad4e2f57cf130ece5bb69b01d977ba598768

SHA256
8a885070ee8381ac9978e62037ea6805e331fe3ffa6c928fa6e01ffa6d13adb8

SHA512
16559d834cbd7afd173c102e3c70e1bf587071366ec16b9a73f9ec8fc4232307df72081f476c69ecf79feb4831dcea3b12cc9962f969115cce4a000b079b5b69

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
43KB

MD5
5b636ce741a936ebd4e8a3db855b0925

SHA1
db884a4d900b8f79964dd75426fa662bbd935a8b

SHA256
0a5237859125b9d1a810fbebbb1789ac721f4dc68dd233aaa1dfdd250a142c6d

SHA512
ac60b9b75388d8e3884367bd000fa7bf28b97125e58195616ff1502615862f1e0f36a65bf4d40324e8ec6c6fed974b96f5cdaab25167a4a6504e1c6bd234894a

Download Submit