be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
Size

52KB
MD5

3b1fab5a8a11bcb2e83477110d069380
SHA1

776ee1b4b5516669a7c620e9430af44a14be0489
SHA256

be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96
SHA512

d595a841fd7f9b8d09326adc06b8bdfda33c5a466c3b17100e1583df592cf32f3654580e4a2450e55ac5519f3fc5d737fa3a94e56efef928ad77080ccf371735
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lz/g6sHzcXHzcC3OTHTQZ0Zo:W7ZhA7pApM21LOA1LOl6l6YzqzV3h

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre7\lib\plugin.jar.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qatar.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yerevan.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre7\lib\zi\MET.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santarem.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\London.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmad_plugin.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\main.css.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\DVD Maker\Pipeline.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre7\lib\security\javaws.policy.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Brussels.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe

C:\Users\Admin\AppData\Local\Temp\be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
"C:\Users\Admin\AppData\Local\Temp\be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
52KB

MD5
ff51158685864e99f0060bf903b447e5

SHA1
57e34f26c4d89400ccab9711c5bddd3e56fdb31b

SHA256
5d4fc5700ede26b151a3690a15ef3f9ada1a0db5e2cfbae9d942e00215112ddc

SHA512
a42b4d93ba5abe60db1fab109fcc14914d728b34480d9c62868af53c93df8afe6053a64789fa8adfd58fb0a49d019fd7b4b19aa231073d82bc17c14131910cdf

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
61KB

MD5
3466b6189833e75ea4da353d645a0578

SHA1
3e9594b7d5f45f10798a9853e1766686ce5b0cc0

SHA256
7a2467b3056858340ecfadcd260d6a8edbb7d211e3accdac722d29cc3e4c9b46

SHA512
9ffbdd093bc428ce9dba5b3051a2677bb334291be057556ef9171e8e2ac54bc5f28923dba02e7dc01571402fb797fb538c10c26b0dc64e8fdc18c6cd61315020

Download Submit