c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 21:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
Size

65KB
MD5

eb6acb700f68145fa4c27c2edc26dfc0
SHA1

b1a56022402c864b4b36a66b733e11febb66a705
SHA256

c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223
SHA512

c773f637fa07193d430cb46674721da44346807e409bf5ad574eeb46de02174e0a29cc7ca6dbe252a78fd2f76525e24c199d96594dfc1f0e0f802764add5daea
SSDEEP

1536:W7ZhA7pApw03vR03vcltdtSsU8Tu8Tmwzw3w1:6e7WpwYRYUtdtSsBc3w1

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3112) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\vlc.mo.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Net.Resources.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Beirut.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jre7\lib\deploy.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Anchorage.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\.lastModified.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jre7\bin\management.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe

C:\Users\Admin\AppData\Local\Temp\c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe
"C:\Users\Admin\AppData\Local\Temp\c48a9f10b08dc909f1337317911b9eb4dcd975ff18918a03a6665f6507dfa223N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
65KB

MD5
8d2730f7ca7b5a0bf37a1505d91f7835

SHA1
48eb914e208131b1375941ca141ee3bf6d2fc051

SHA256
24e06b08c56093e9488d88cccda6f42bebf1ead7d997a9c8a7827d1d10c8ad08

SHA512
f387e56c72429ad4042ce85a6ec6db5ceb50970bb42abb5b5f51524b8343dd00106f9333a9df2476f7d3e969aba09ad93b19d5add15b943cf10efcecba57befc

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
74KB

MD5
d050052a0a838bdab8352e2ad515d141

SHA1
7da336a8e459d82075787d12a3a038cba099a322

SHA256
2bb074427ef9a17ac407c0c457e25cfe6228568a598258862de8af8b458ca928

SHA512
361b55412b93c32b506454303b060b3c15fd458279aa6f0baacade69d0e29aab0c0dc7f1f97465d087ac152cfe49755849c6b2c0b9518be9a4287546466ffb26

Download Submit