83435c02d6e659d1a1bea64b7b23322a78038f34fd209d424a782a2e921595b4

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
Size

77KB
MD5

bd1bae7e9b31ee3d3b72917e50b43bf0
SHA1

98595e0c766d0b69c561ed65665cae3dda297fde
SHA256

83435c02d6e659d1a1bea64b7b23322a78038f34fd209d424a782a2e921595b4
SHA512

01f21b01d799057e9470e616eb1af6f4ed7d93baeb0c0028e53041809346372c23eff8b8fa4bd5d3cef9977ddd9c903e0bc562258b11d81bb38c7a7f106dcc2d
SSDEEP

1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOMETC+cI2I2MkPMkz:6e7WpXYvnh34

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3073) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-3.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.png.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\ChkrRes.dll.mui.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.sig.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\EnableInvoke.ppt.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jre7\bin\rmiregistry.exe.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jre7\lib\content-types.properties.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe

C:\Users\Admin\AppData\Local\Temp\bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
"C:\Users\Admin\AppData\Local\Temp\bd1bae7e9b31ee3d3b72917e50b43bf0N.exe"
1⤵
- Drops file in Program Files directory
PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
77KB

MD5
3f6705e6448c53c5347883940d5f2367

SHA1
3670a597fa72cd5b02afd9c2f8cefd6c3130f9d7

SHA256
9e27500ee12662e4e649cbc7fa9d6cbf0b396dff99381d5811c194b8bbad5a6f

SHA512
3825fa65f85e4dc7449091cf72fe1c42599e2e6e036fb053296316348d18f1c6795038ec3c074bc072c069c475d5b021690230c25445abcd86d005cb3ad11e1c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
86KB

MD5
2f80454ff4142db9b9db32ab06d6e194

SHA1
e6bfc3a923a8d2647548e6610bd6e7895c1d4c76

SHA256
77ac1223e4e878731b974fa52680bf8d2939b561b832055768729dff7b6422ce

SHA512
cf57ead4b359a3dfbc735b5f4828d957d690f6784c740a313c6f57a7f078196480dc402e90aaa5242dcd33fe732b57fe9b01fe406d087a6a2dbb47922d6e82d7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads