a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe

Resubmissions

19/11/2024, 16:16

241119-tq884axqe1 9

19/11/2024, 16:13

241119-tpchqsyfkk 9

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
Size

149KB
MD5

798f3a3fddcabbc80f9f5c68f94f0408
SHA1

0172c7c3401dbecd89e562167e9dc32b52da7652
SHA256

a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe
SHA512

d99339154fe1eeac97a6c6a7858804d465bd741d89a2391716e87a1875f17789ad12b77a7aba3d0f68bf2196499dbeef876e5f173b596e04c84b5114b7461170
SSDEEP

3072:6rWpcsHEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsP9iMGfU8:tb9iMGsSaOyif

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2648) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mazatlan.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\LockInstall.vsw.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\bin\installer.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\bin\jsound.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe

C:\Users\Admin\AppData\Local\Temp\a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe
"C:\Users\Admin\AppData\Local\Temp\a2d1a361dd68d5c9d1137efaaf9ae7e82c763b9e6472bda985188518c92c5fbe.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini.tmp

Filesize
149KB

MD5
6b9883fd4e4b83309c7422ac960b040b

SHA1
db7398ec73b89b5aff5f954d8a4d9a07741b1e5f

SHA256
133884756c0bca313c84cb76df66d92e084bfff0ba6fb34f4faa66aeaedca638

SHA512
de17f93f70c0a463886f28b5974e28937636d3c721d2d4bed3b1eae068aeb83553cc781d8ba2778f483f431381d7525964821c6184772131b1d7c519cbb6da76

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
158KB

MD5
310ca48d2bccc7bef722f4d5cb23bec1

SHA1
97a2a7654c653fa202dbb421f5a5ea7de6c21481

SHA256
43fb8eefeb9ef5d2ad168e92a62673f35a1b4d1b655b4bf316b199b9e22d94a4

SHA512
5e374576848c17b0c46a8d2295c99b2bded3c7241b3699b25c64bd37c663248ccc103ad6b7a2334fbc602b7e9f27e200268b0256acfddfb02876348477eedbaa

Download Submit