bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc

Analysis

max time kernel
150s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-08-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
Size

42KB
MD5

84e7cb764ccdcedfbba9230deed896b1
SHA1

ce5b8c638d16f67a0b7682eae6af69203790af72
SHA256

bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc
SHA512

e5fa0b54cf4e4677b519b96c0530064dd28872469376cb8cf861f1e905ae29a2ef8422ad3b342ee72aebafbd6ade76455fb52a7e2eab6aff63f8cf07d8186130
SSDEEP

384:GBt7Br5xjL9A7AgA71Fbhvn+nDm0CAmmLg5Ms7spsZ8HYGkqvtJ+Jo/YdUdg:W7BlphA7pARFbhOm0CAbLg+so/YSi

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3838) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\gui\libqt_plugin.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Games\More Games\it-IT\MoreGames.dll.mui.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Windows Journal\es-ES\jnwdui.dll.mui.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_rest.png.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\penusa.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_sun.png.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Windows Journal\Templates\Seyes.jtp.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liboggspots_plugin.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDFFile_8.ico.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\library.js.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\RSSFeeds.js.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe

C:\Users\Admin\AppData\Local\Temp\bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
"C:\Users\Admin\AppData\Local\Temp\bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
42KB

MD5
50548439d1ff06b142243941eedc3be2

SHA1
b31805868793ed36f05c68bdcc74cbffa54dff30

SHA256
558ddb4009d41dea5acabdd3182f410d6322d63e03f7e781021aab28db2e9190

SHA512
563a798364c87c11c37352535f2f169422c51a668565244d375967c1669dd5926b11184a11bb1199f1493e28043746eb7ddfad13d930312b44c64ae8a8da9520

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
8725f8ad0d6721493916f314833f9fba

SHA1
a024d0764cdb0bde7ae6568253ba9b0ee32953fc

SHA256
f87dced4da51f9e57fc2d2fcc2288eca208e104c25e068c1f5d6683c3faa6f8f

SHA512
aade5af4085947936102a20aa2286d28dff40e173959931624af183840674be34031dec26e865d7759c7b32a1d7ada24bb5b075e5ecebe1001d3c9af42d1ac32

Download Submit