33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
Size

76KB
MD5

75bf1ece637c4d31d4122fcdf40ff0ee
SHA1

5c46fee7a2119338e94cd06b94cd3538d0eab981
SHA256

33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68
SHA512

d0c8948c4b24a1e9e23bbab0d896245f6ecbe7f6f0cc2aae68f6c92fd53575294c9baf96c7fd59b1378bb9d6d24ac0c4434d5be540daebeb4593c49d38a6fb48
SSDEEP

1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8zxY5eYm:6e76mQSox5u

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3486) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\gadget.xml.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Mozilla Firefox\postSigningData.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\gadget.xml.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)notConnectedStateIcon.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mousedown.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Printing.resources.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_thunderstorm.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_m.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_up.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\notConnectedStateIcon.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower.png.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmod_plugin.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe

C:\Users\Admin\AppData\Local\Temp\33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
"C:\Users\Admin\AppData\Local\Temp\33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
76KB

MD5
dc4f59a4d0e34b48a01de5ab4402e3a5

SHA1
697f9a8791dab2fed5cdb5bc9eeec8d61aebba36

SHA256
9dcc5f6fe2a00ce23e5b08539a1e0966a0ce5a3ea5588cf24ca76a6d41a9a5eb

SHA512
9127a2d84e76e76cdc85a813c7835e1d4e7ec716666d8261a9e089d877d2710addb27a089e924cfee3752be4e4a8c375f7961b789d3a4fcb0979b3ad29fe0ff8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
85KB

MD5
a85fca67dd31dd2262c22e6b6cb3818a

SHA1
1e252cfe6510b87b9b460c69cad498a1bf89916e

SHA256
5d084f78870c0f1914f611c76fd04a45254eec5d8d77ab6a472b7b89effea8f6

SHA512
b564da223912552e6ba906a44c3e9bf075a01d6b83dd1d03167bbb6adf0a0d8c37e522d337dba1589b32ef0898757de00ef7caf52f0aceecda39a785dcf4e460

Download Submit