462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
Size

47KB
MD5

ef76ea4f46278d42b6f4ecdc58b56a8b
SHA1

9be3a367b185635d647af326979bc3f6b2fda184
SHA256

462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20
SHA512

43558e5ef035ec06fcc4842b3405149988f7d1b8fb71e2221197c796480c35f242842721406bbff6dab1725507432ec8d7c714a70771e2399683cd6c9212ca8d
SSDEEP

768:/7BlpQpARFbh1WK9WKzN1J3DCl4N1J3DClk:/7ZQpApQKIKz

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3841) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Windows Journal\de-DE\jnwdui.dll.mui.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_pressed.png.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmicrodns_plugin.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\settings.js.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Miquelon.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jre7\bin\fontmanager.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Mozilla Firefox\IA2Marshal.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\localizedStrings.js.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jre7\bin\jsdt.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jre7\bin\klist.exe.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_docked.png.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxT.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jre7\lib\flavormap.properties.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\micaut.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnscfg.exe.mui.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\cpu.html.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\RSSFeeds.js.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-3.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_ja.jar.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll.tmp	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe

C:\Users\Admin\AppData\Local\Temp\462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe
"C:\Users\Admin\AppData\Local\Temp\462e88f708671b04dc8d3eadc785779fc46f02c52d9a6f98ed02d3eacaf2cf20.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
48KB

MD5
5d5eae3d965efa50da977257d8a3c9f4

SHA1
79458b902d56220dd7fc03a6ed2a441ab1342409

SHA256
cb4f975c38b3f148d827c5d13b1c08a13d5a93f51151439ae2a32dabcc7e3c0f

SHA512
26200a535ddb7d6fea42e710360a6bfdda970483606b21e50a8bd16a61a9b3572609f36bf282805165e06cf81efb084fa67800e246eb214fc0cabf741afc1452

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
524bafe675761f9d88324af62f4eced0

SHA1
db3fc0eebdc947bf764baf7f209d1878e17311aa

SHA256
3f9572a3223566c474448d03eafca761f84202e3f4556c3f3429efd39f5bf05f

SHA512
867e9f53e8284308fc9252601a247ac00a0a49d93839b18c281bbde569871733f3af36d66e5c563694e1212e2e11fd7ab30891f0a6136747cd87d1ae78f725bf

Download Submit
memory/2444-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2444-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download