02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46ae

Analysis

max time kernel
149s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
Size

50KB
MD5

9a2ab7a090398ec709cc2404006ac140
SHA1

273b71c5afe275198a8e32fcc470ee7cfa11e12e
SHA256

02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46ae
SHA512

3ea8aa180a60300e7b2019755816d56a99d6ca5fb20c47f2aa676e1bbaef20cf634ed4677d9f806ce249d7c4f688020da91e678149b9d76cd467692b128318e1
SSDEEP

768:W7Blp+pARFbhBgnKLMWK9WKD2N2LSarSaxLeoVERZLeoVERM:W7Z+pAp2nKLRKIKqoLSarSaeWM

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3775) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-api.xml.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\extensibility.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_thunderstorm.png.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jre7\lib\security\java.security.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Resources.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-vertical.png.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_right.png.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\20.png.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\ITIRCL55.DLL.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Windows NT\TableTextService\es-ES\TableTextService.dll.mui.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Godthab.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\settings.css.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\hxdsui.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Toronto.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_few-showers.png.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\TipBand.dll.mui.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe

C:\Users\Admin\AppData\Local\Temp\02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe
"C:\Users\Admin\AppData\Local\Temp\02ac6e0297db89722f6ff582359464039b834da460844cfc51390b0aed6b46aeN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
51KB

MD5
4d705f86a6b936fb9a1f7e259d2165db

SHA1
5f855bfd8e588410aab81dce3df7bf45ed76f4f4

SHA256
6e006f09ba5f27efa4e1f90345f4a0a664c81ca80e148be093c957a794f9b5f5

SHA512
bff760e65c21d242b8e91a68ffd038e57c16421b6844f620ac3bbf74339c25055806d7842756f5936f5e423cf1e9c0d6512585d8c03e57cd5a680252329eb06f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
e9c736d74885fe7e9d413efa5d865789

SHA1
7fa831a36f18a0492449b0d6fcfd08a41425b4bf

SHA256
da5960fd16eb10476c0b744cea6d312133a018b96f90f525438991381631916a

SHA512
812fba833cf203f1a813ac85970b92e55a6657b749c5e22e3c1cfa7d5f1e038380f6fbb60b323a1436d867f4193c4c55d94c0dfe92672030cd776363ef034b9f

Download Submit