312bdd42afbdb8dd24ee7e8aebd17de1a8da052c743ade17f2ccdc957ebd3736

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
Size

68KB
MD5

bf9ee2e0b4ccac66e8f88aad9c68a750
SHA1

45e71e4eab2fb4ebcf2639d4f41dd64c7c74b627
SHA256

312bdd42afbdb8dd24ee7e8aebd17de1a8da052c743ade17f2ccdc957ebd3736
SHA512

f7b4b136f56e54d236b3ec11041a1e6355c9b0fcbe159252bd2edfa10847c83c9cf894de2cea3809a8fc8f588739f88ef17214365377573360a529e26954d817
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEr:/7ZQpApze+eJfFpsJOfFpsJ5D1

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3139) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST5EDT.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Almaty.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Melbourne.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\uninstall.log.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.tmp	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf9ee2e0b4ccac66e8f88aad9c68a750N.exe

C:\Users\Admin\AppData\Local\Temp\bf9ee2e0b4ccac66e8f88aad9c68a750N.exe
"C:\Users\Admin\AppData\Local\Temp\bf9ee2e0b4ccac66e8f88aad9c68a750N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
69KB

MD5
7778eb064a5c44d09521fb6815ac4526

SHA1
3234b3e37999e58902a921c0b1f601ce1aebc94d

SHA256
efbf8c1e87ab84c8db803f846caa0e7262c7dba4154d93760d782df9f7c28ce5

SHA512
e024b7d370974ce604b038291716fa2e9fa4e567b54c1e64da825bc858e178515afac24bb4d76df5ed159d337c3102c217b33030d95adbd903a7a23c010f4431

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
78KB

MD5
c7c6e48df96b4c1cd753950b0d8dfc69

SHA1
e3c362fbcc2ba3b0b4163a3b9809326c5fdf4dea

SHA256
998f84db38d3944a4f77e5b58a3da8cbb1ab9fe77353dc0911b48e3339ce5462

SHA512
c5522c8bdb0ce79ff6cedff800a78fb25bba57606748f2d6ff9b0f1b6d01b09a009eb854c9e705a30a1d19d5832a02be2135773f808269e5b5a74d4a3a656d22

Download Submit
memory/2756-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2756-646-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download