815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
Size

63KB
MD5

5aee855eba8096c759a0d4ce318ba640
SHA1

8e9e020210867ec90c1247c1600c5cf7a13ea8a0
SHA256

815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678
SHA512

6a9e8d13e3745c17209e9d2e8a4fa170f7d18a3aa68f4a495840c3ac2ef7c24f81550e93ebe1e36cc303dfe2bc84492726e740f76c27516104426c18cda0c180
SSDEEP

1536:W7ZhA7pApw03vR03vcltdtSsU8Tu8Tmwzwycp:6e7WpwYRYUtdtSsBcycp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3204) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Solitaire\ja-JP\Solitaire.exe.mui.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Martinique.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tehran.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtospdif_plugin.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre7\bin\rmiregistry.exe.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Internet Explorer\iedvtool.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jre7\lib\security\java.security.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe

C:\Users\Admin\AppData\Local\Temp\815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe
"C:\Users\Admin\AppData\Local\Temp\815e2a476bb685c33fbaff3ba4e320173ae49aab496fe88b2a7370329d928678N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
63KB

MD5
cd57d2a5c4298fcc6acdfd68d5ef5c85

SHA1
fa5e8d29ba2e74919bb7ce9e93b763dc28e28e90

SHA256
3c6f3078268bc88fba4504f8d0901a27559e878ba185f3c8406ad611285aefa6

SHA512
8981cf74259ee131ca413382ab2a3926b1a98ad72867bd18f06c5faa551cf188999e7a8bef0467a91da221e709237fd9e25251c7d219d422c214c1c29dd0a6af

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
72KB

MD5
2658f19839268e58ee98e0ab19b321e8

SHA1
220ef0a6d141a0ff5663a57988a244aaef499ce6

SHA256
d99e867de700188d17efaf3be175723245a72886a1ec8e603e6a14678b3fa928

SHA512
7b406a6f1f85950ac621e16e16273a53ba865abade79934378e0c0ea1d757cddcf75d564c808a6c7bdc9a736fbd72cde5ea66767aa89b6e277035828e9509046

Download Submit