9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
Size

35KB
MD5

b7e06596a075cb498d59e6cd44dffee2
SHA1

9414042020003a7b20f058f29e8dede49a43cab0
SHA256

9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36
SHA512

7278371e2c807e2f58210995163e9c4da356476c46209d1545c3480ff05ff42a1f18ad74de7e49e5dd707eda243094b9c9eef66da455f3ab3a36bc919461deb0
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxje6OMmy6OMmB:yBs7Br5xjL8AgA71Fbhv/FzzwzO

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3886) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\glow.png.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\gadget.xml.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_hov.png.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\flyout.css.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jre7\lib\ext\meta-index.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Perth.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Windows Mail\fr-FR\WinMail.exe.mui.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libglinterop_dxva2_plugin.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_settings.png.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_rainy.png.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\highDpiImageSwap.js.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\24.png.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe.tmp	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe

C:\Users\Admin\AppData\Local\Temp\9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe
"C:\Users\Admin\AppData\Local\Temp\9d8aaa7e83048936ec9bf82746b91f3302659ee5d7e4063f131314d9a0776f36.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
35KB

MD5
59093626569af2610de57d72092b4f35

SHA1
c332e3355be550a473dbfc8808ed83a044f6ec4f

SHA256
afe59b7a607d9ddf60dd902c040cb1c11a4f10d62046ecc46d08b20402785c1f

SHA512
55a62b7b20892d573b32e71766c424b846f0dee6080e2cc6a93df76e29165449c25f0fdba24a04e4e623c37439de3c74fbd0e99623e8c13aa22844c1c5e4f335

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
44KB

MD5
7c1cd372f8cc3ef5fb0fe32d6749a377

SHA1
0188e19acf85c6df48ed85b9b56cd3c38632cf1c

SHA256
14193e90f0d71b7802314a734d85500015a189b1584b9142992823b35bffd466

SHA512
99efea414637845de2db36abdd194f3b58e44a8fa45ddf15c3a6023498eaa97794a0a171428aadf39c7dc5d408ad66433a92ecdfb88af981858cb1c4426eac67

Download Submit
memory/1148-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1148-660-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download