8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
Size

46KB
MD5

2a4a3a7f530d8413ec2bd03152a081de
SHA1

fb97cda30fe2bf40f40399ff6623bf13d0b76267
SHA256

8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf
SHA512

f21d05608ada0b7a3935496f041e636b01b069a9f8b726b16934630b555fe453907fa184f2ef6d465f439bdf103c78bab3621b0ce36602a9bb3abdad3f135cc4
SSDEEP

768:W7Blp+pARFbhBgnKLMWK9WKD2N2LSarSaD:W7Z+pAp2nKLRKIKqoLSarSaD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3520) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\settings.css.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Mozilla Firefox\nss3.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\RSSFeeds.css.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Windows Defender\MsMpRes.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Windows Media Player\ja-JP\WMPSideShowGadget.exe.mui.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Windows NT\Accessories\WordpadFilter.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\DVD Maker\offset.ax.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jre7\bin\rmid.exe.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jre7\bin\jsoundds.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\slideshow_glass_frame.png.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_h.png.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Windows Mail\es-ES\msoeres.dll.mui.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.png.tmp	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe

C:\Users\Admin\AppData\Local\Temp\8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe
"C:\Users\Admin\AppData\Local\Temp\8a95ffab108b2729442bccd26f0069d36c5eccac09b50dd61bb2a678c6bea6cf.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
46KB

MD5
452fea1109d627a22cccfd480f46acdd

SHA1
7c9c35fd0db157c04961dffa47858756ef7bdedb

SHA256
0ee57121f059c37567603367f4dd960ed18f1ce8e3dcf551e4ad98302301d21f

SHA512
c4142ce700a75501e15f43eaf3df27bfb40e8c72e65ba18034b61c75aa4b9169d9691e63da8d77c00014109bb2463cb5564ec63e6ad0ff96d1914271522e7199

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
55KB

MD5
89ed28eb26820c58d59a498eb6351d21

SHA1
0ec82f9923dc131802ade3a2d4770af90b18715d

SHA256
9e04eec253d9c935317f9579cd8da64de4e061f72738134ca0129501397de84b

SHA512
1ff601a7fa73b3f1980806e723c8d222fbcd67dd67fb347cc3c3e9647ea0416982b51a566bb13f4a7146fbc260d47eaf72f2bd368a28e3e620534ab4f4c4b61b

Download Submit