1ea19b07d2ea9469b7ecc24d29e1febdd3d6d55adea32d9632a5c4ec16324585

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf9b2c15f64c4500dd9980518433dea0N.exe
Size

45KB
MD5

bf9b2c15f64c4500dd9980518433dea0
SHA1

af48a611207db23483750185bc22ba1d23836478
SHA256

1ea19b07d2ea9469b7ecc24d29e1febdd3d6d55adea32d9632a5c4ec16324585
SHA512

a5cf20da3d2c66d0ad6734d5e5d85cf533928f01981f6e6f371465fdc8ffb1df97e4c82421c693ace51f437bdec81f632182ba9a0f6e3a7d71ad018731fec04c
SSDEEP

768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJWX0kXX0k6ol9OiJfol9OiJY:W7ZppApkGp4G+

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3327) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Internet Explorer\perfcore.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Monterrey.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Accra.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Noronha.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Whitehorse.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre7\release.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf9b2c15f64c4500dd9980518433dea0N.exe

C:\Users\Admin\AppData\Local\Temp\bf9b2c15f64c4500dd9980518433dea0N.exe
"C:\Users\Admin\AppData\Local\Temp\bf9b2c15f64c4500dd9980518433dea0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
45KB

MD5
31ff334ca09cf325ee18d0a2591e0688

SHA1
762149b9fb0155fa09a49688f729f2e31c6bc7fc

SHA256
15de2e38e1d3f901b5ccd9d46ac8f9cc9e33fe87a1eea29c90536cf2b845e7ec

SHA512
7b2bfc9df000697010e012a75d1a382ae59b77d87bca478f225c52299d1ee4da61ba7b4dbf1f0ca79385d9a983019da889f446a08317ab2640a90fcd73f3ecb2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
25eeb4f388cf6bd2787580461306fc93

SHA1
22aa440157e72256c14c5a67fa0c9e316ab96155

SHA256
c0c630b99fc09d08c23fcc760dd83fe71a272050e2550584a56465cccca3887a

SHA512
fdba1899fc20a3e533c6c8f3e053ef93b694d00a29ffe35076dcedeee55d2718cc04da7549b39384f0e658f8df227fb4690e5195259c45c173edaaf467dafd3c

Download Submit