992b6e58278c68408344da5a503fd5e52192ee91a4462027391545dffa9b97ed

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8cb84ee709cdbcf8f667f6071763b6a0N.exe
Size

200KB
MD5

8cb84ee709cdbcf8f667f6071763b6a0
SHA1

00cccbedb0901af98d60ae0b4187b84acc9dcd0e
SHA256

992b6e58278c68408344da5a503fd5e52192ee91a4462027391545dffa9b97ed
SHA512

6a60b34b1b0b29dd59e07b422b4aa05c49231112466726d771e8905026395b708e39c8b05f91f2a00b49c5cbaf12cf8d57ff3a2cb0bc8144f98b202bbce65e50
SSDEEP

1536:W7ZQpApfytyxsks0DjdesgHOsXOHepOHeI+e8ccT+e8cct:6QWp1sksHsuOsOb8ccTb8cct

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2736) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\DVD Maker\Pipeline.dll.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\PurblePlace.exe.mui.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jre7\bin\zip.dll.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Noronha.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Phoenix.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Microsoft Office\Office14\Custom.propdesc.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsdt.dll.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jre7\lib\charsets.jar.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Java\jre7\bin\java.exe.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	8cb84ee709cdbcf8f667f6071763b6a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8cb84ee709cdbcf8f667f6071763b6a0N.exe

C:\Users\Admin\AppData\Local\Temp\8cb84ee709cdbcf8f667f6071763b6a0N.exe
"C:\Users\Admin\AppData\Local\Temp\8cb84ee709cdbcf8f667f6071763b6a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
201KB

MD5
0e90a95bf63bd12a296769ec3c88d6b4

SHA1
30f03bbe2283730f935336877f8eea3461bb47dc

SHA256
af5dc317e1efa1aaffa4dc34cc2bd7d38281d31e4c885bfa93807f2233e43da2

SHA512
80d0a755b5632ed75bbb192bf97c6d26d884f292177a1c53a979fc09fedb1fb896961f212e0bade28836db51d73fde3aa5de155575f7eec12835b5558c6918e6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
209KB

MD5
f9b27789cbd5b341fb18877e4a3dbfd9

SHA1
518d138a46f8c0a3f74c3b8cdd607c7958d30b64

SHA256
16b15750a19e8effe1d102ff7dc3c7d256b8e6c0b0da596ac721dc03fa6c40dc

SHA512
ac590d9431a45980a242b8f8ba6d1caae774f3d875de8c29759a1b05c44865c289c61e8e6931b98ace6e82ecd58fc53652e44aba02dbeda8c417263f26f558e6

Download Submit