478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
Size

56KB
MD5

cadc577caf4cd129e0d20e4acf73a320
SHA1

a32ccb75d533fd789ac8484c7c0d187d70147452
SHA256

478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222
SHA512

5385f4f6d31c2e6e7e518516d855d2f7a952dab73a5246f4a9d9121393c2f2540f457684b5ca0634958a0be1493134df8ef474d9c9c6b1a47e5841e3f8cf8f3f
SSDEEP

1536:W7ZrpApojswv0EhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsot:6rWpcsHEhLfyBtPf50FWkFpPDze/qFsg

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3213) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Mozilla Firefox\mozavutil.dll.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Mozilla Firefox\application.ini.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sao_Paulo.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsFormsIntegration.resources.dll.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.tmp	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe

C:\Users\Admin\AppData\Local\Temp\478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe
"C:\Users\Admin\AppData\Local\Temp\478daf8416622274acacfb0309187cd16f02d2d5690b44a109cbf84a45904222N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
57KB

MD5
83b132de08191d062ae1c4ff4ee6fa23

SHA1
1660eedf09203b5b486001e3946f6814fb38c59e

SHA256
e88f45e03910e5cdbf31a58890286ce95c5a2778984e10043897cdd75a4360de

SHA512
f16d385e1777fbd3c4496368a548874f2b084dfa5da9215b03e8d50b5694d02308a19e8ce797bd8c0f5179444e1af1aa8db52de14618437cefe295a6ad4b5641

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
65KB

MD5
226bf4d07cced85ea2f26badb4808d2f

SHA1
110d832313c1a6756ab4c8687fe5bfa9943562a5

SHA256
6b688dcfd5258e199c1488608a72c9890974828afe4a9cbf19e1a825f09a99bc

SHA512
02e1029aaa882eaa6c3417d9cbaf7698f1ce13aa6c1b6c5600515f2a097d26b5375096a328761174624eb1fd13e5c9ecfc1fe3565a678d32122d3e41f0e90468

Download Submit