5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
Size

35KB
MD5

656abaad0068c9e95faec780f5a34fa0
SHA1

3898f8a61d4f2b54b2852d1192cd79fc02972d99
SHA256

5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787
SHA512

8199158e2e6a7085a0d290d0435d2f3fc8ddeac186015f9c86ad39a59557b6c89ed3c80a3a9a3d288d26ff801d7a504d7cb92f4c26dfe9cadcbf897b96247d3f
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltuZSZA:W7ZhA7pApM21LOA1LOl6AY

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3295) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.ini.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Maldives.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_chromecast_plugin.dll.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\New_York.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe

C:\Users\Admin\AppData\Local\Temp\5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe
"C:\Users\Admin\AppData\Local\Temp\5295424b588552f6d548d5b6af7c1105cf10c1618c799e3b7cdc2c223ffb5787N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
36KB

MD5
87723e62c614fd7689f871b85290637b

SHA1
240718e88f862d05adb1846e87d926496e2477f6

SHA256
c8183be8b8a6c010c53a0bd9530fc73d6c1a5ff49bbed0405d933dab0aad9c71

SHA512
f59008cea36cd1c7691ee4d0ea45761904433b3ea6bd2dac00d29f16191e1942d6657c612d95594a0a84df82e1ad4fd68379e15900531fc2faf73827888e9870

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
45KB

MD5
76dd970d3318aae124adabd0e1ab1bcc

SHA1
8d12e98e48c07ce395b51b28d903c75c264bc7ae

SHA256
b62e2800527e0f371e3ace5b0a2f181a657c0abc2502e467caaec857dd944c8a

SHA512
a08bd98e81b54be2292ace5661478ca3994b18fa6284874f4be0c9db8710e033a6a52ef6a0e8e5d52ded14ac52a80417f9fe6e6c593b8ac66d6f53f30a5cfbd5

Download Submit