85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
Size

48KB
MD5

7ab57355d9163ca85c88906197e4283e
SHA1

8a2906d21f0d2bcab42e6af9e62627898cee47ec
SHA256

85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b
SHA512

6ca01d436c71d1415c1545d8af1e6af9767201fb00f919c8faee1aa37ebc82ba07fac8166698996aaff6ca363cfc79b420eaecb60a027700e952049427d25c47
SSDEEP

768:W7Blp2sspARFbh5YSfff9n1oXKCqzEIn1oXKCqzEHcA:W7Z2sspAp5YSfff0

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3770) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\gadget.xml.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous.png.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jre7\lib\security\local_policy.jar.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwjpn.dll.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.access.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-actions.jar.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-io.xml.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST7MDT.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Windows Defender\MpEvMsg.dll.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe

C:\Users\Admin\AppData\Local\Temp\85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe
"C:\Users\Admin\AppData\Local\Temp\85de9ad4b9510e5f69b72bc464514eecdec93ed541b0f4977f0582dd3169e79b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
48KB

MD5
518bb34244f06cedfc7d555cb98441aa

SHA1
3402609363af05b8fd7a37b49c9141614e3b95d1

SHA256
ad0ce70ef2cc10e2ee30d3a4529336d7ced3d3423b911957c67efe709fefb27d

SHA512
1d4272a7b55a020cdfb01e45f843d761c39d0de66c101ceeaf5c61a1d7c05c4c2de02dde0aaa946378e656195154a330c2177be682381cb6d47508a4a87ed392

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
57KB

MD5
f1553d88fe7350cb985436a1d5e6d235

SHA1
31cdf51101645ad2fe788249e5a4a6581e21dd4b

SHA256
06c59211d6be0fe18db80a939d70a670ef05451ee6776be684b2e23ffdd0c13d

SHA512
d4e662402c3c6a78c7902363408868a4c51850818e879290b8760ffc3fe8a8643a76547c8ffdad84dc6a3c98b0ea518979b1a2be87198f587f45fd48fda9cb99

Download Submit