15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
Size

49KB
MD5

bd64ccb82fa550d9b70de1d7ddf16380
SHA1

80068fdd63368f1986039ef95b05955e1e38c268
SHA256

15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70
SHA512

fdefbf44a88396a21b10ee19a679bd6fd25c7b2b7b50f6ef5ffdf4ebb60f14080c8f671413849b83027447df1e6c48739c5c2f9431e5e945d06e66eadacb501b
SSDEEP

1536:W7ZppApcZ/D5zf6ydyf+abMkF24kzK3jbrCkoRWNkzZ/D5zf6ydyf+abMkF24kzo:6pWpcZ/D5zf6ydyf+abMkF24kzK3jbrD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3773) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\mip.exe.mui.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Windows Defender\MpClient.dll.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\settings.js.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d9_plugin.dll.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libwall_plugin.dll.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Windows Sidebar\de-DE\sbdrop.dll.mui.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPDMCCore.dll.mui.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_down.png.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\settings.js.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Mozilla Firefox\precomplete.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_right.png.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe

C:\Users\Admin\AppData\Local\Temp\15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe
"C:\Users\Admin\AppData\Local\Temp\15c96dfa7acfbfbeb98c8eaea16ae84973b1416e7e63cb15c599d21e1be79b70N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
49KB

MD5
5fb0d871e02d7c5c866df293d43215ca

SHA1
06e4c7f81987da2c940a51426d393db803b4da71

SHA256
68f0c8bf9e7080711dfa6d54b54f43226422f3552b15988cc3649041f4b1abdd

SHA512
9b8f2bb45c50232df1fe3736cfc91e40edbb5a3c0f0a0e15dd28d5817005da7711a3ce92bfcc64b6e1b7566eb7f6c5642dfbc5da0d303889279feaf7c7c3737e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
892e022b9c20df8e864e5fb8450f220c

SHA1
b4fd96961be48c6ebdbf6ba0f76832f552b70721

SHA256
5d6cc222a55878e8a77c0d4fb7619fda27170c0ccd31b0e7daff10478d52ff21

SHA512
9d1162706aae607b425af017fcba5e9a6972522230215f84e51e343a76dd80f880f1fbe6c60711faaae4972800b7ffeddd5185fbf97294e98c4ddfdbf39de9a2

Download Submit