49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
Size

51KB
MD5

8aa3eb8bc27d7cc06b56e852735ae030
SHA1

bc3cc357179cddb101fa956ac81b67f27c99d0a8
SHA256

49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30
SHA512

a712389b516a4e53a4d61b2fb8ca5617eefb471215aa5202cb2e952252cdcab7a9b23961b87235e233ad1274ef44048aef1ab22acae41a9b5b0d7be92ad8a508
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOd+QRA88O1ggi1x+88O1ggi1xYV0U:W7ZhA7pApM21LOA1LOTRAsWysWkWU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3738) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\timeZones.js.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\library.js.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\TipBand.dll.mui.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\settings.html.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Havana.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Net.Resources.dll.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-print.xml_hidden.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\VideoLAN\VLC\skins\default.vlt.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Media Player\WMPSideShowGadget.exe.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\gadget.xml.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_left.png.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\gadget.xml.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Journal\Templates\Genko_1.jtp.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Journal\ja-JP\jnwmon.dll.mui.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Journal\jnwppr.dll.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\gadget.xml.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\weather.css.tmp	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe

C:\Users\Admin\AppData\Local\Temp\49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe
"C:\Users\Admin\AppData\Local\Temp\49552914102c29bc156167f3d3ad3f777d7b24ef080b27afe50c3141a27fdc30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
52KB

MD5
5158d337bc109b83a5d33d63e8652174

SHA1
5f31cbbd147bd036568dc4ca38e75a361c39b097

SHA256
d7e6df4226352bc6590e54587f7888d69a405aa4e27de37fff37c0d93ba00003

SHA512
d04c33f23af8fd8fc4bb1039769fcf1281c0016c3cd0599cbd8ec234f16ac491ae25dfdd64a0258078638b1faf9a89a615e2cc10bedf73a70d5dcf7eab869a1d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
60KB

MD5
1087689984c5af626ce4ac575ddd5a94

SHA1
14dbc8eb8ecc6dc5e3993ac3e041dffed23d0364

SHA256
03b91f032c8e824a8d8f7614ef127961bb30e4879b2e72145837afd9f650c26e

SHA512
c2d651840ba58fbf1f170b05db716d021ab30e221101ace9567bdc89d0ab79d0af835379088ee4de69b7d1cf1449ae51d13ebdae132481e8037b1e7ef07ce66c

Download Submit