d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
Size

50KB
MD5

3374c07ec08994556f7fd74f3dc4a4a3
SHA1

5d9a10e05a3dba5f8df6d12ddfaebb182e45be1e
SHA256

d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd
SHA512

52953830f4c36a348cb386acbe4a86cd47c6a3e06288cbdbd8f836af02c63c67bd6d6222f8fe5572a8ef4eab1bbfbd31b51d9e3e21d6008cc25630040b148a41
SSDEEP

768:/7BlpQpARFbhdS5c5mRawAlW1VkRawAlW1V35h:/7ZQpAp86MLkL35h

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3814) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\TipBand.dll.mui.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jre7\bin\klist.exe.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libstats_plugin.dll.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_disabled.png.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.dll.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Bucharest.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\RevokeOpen.odt.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Windows Media Player\wmpenc.exe.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jre7\lib\ext\meta-index.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Windows Sidebar\fr-FR\Sidebar.exe.mui.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_zh_CN.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Selectors.Resources.dll.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar.tmp	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe

C:\Users\Admin\AppData\Local\Temp\d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe
"C:\Users\Admin\AppData\Local\Temp\d8bbfb5889e4baa9dc93b2ea69049895c7eed42b32d1f7a1dcb4769e663807bd.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
50KB

MD5
64ceb6cbe9a89da4d9fe33b7e5e4ed46

SHA1
a63ee814fcd695b1cfe0f18e11d1d439f2f170f9

SHA256
305ec816c607653f5df873f8e5f45f045498cf0a086fd4625a06062080986af4

SHA512
4639e10d42703eb2b2d70d5b482173518dd113b6837cfbc8591bf0bc5b495522db78d09cdffe77a92216a00a964070c6731e0ec4a0595b85ac5405bf0ff11a2c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
e44548465ff3bf415bdf80eca14a5309

SHA1
7ef410f0368beb1f3331ec5dde345d7a4368a960

SHA256
3db1e8c74ae6a10d68926347ad6571a807c7455072d1c5bec41a2d9b262831f7

SHA512
45345295f50c619d643b2e38bc12050cbdc55c9b3a08bedd2d9e664f6bbd0d79ba7f9765365589e2d30cf491deffac3046a7ad380abf1f68dc6d5fa1d8747601

Download Submit
memory/1544-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1544-652-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download