d4e517bc0dcc71e4e2c06e25bb735c398fd687c7f1759ccc92945e3bda190667

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8d8a8348f8b227b7bbe13e97e721670N.exe
Size

48KB
MD5

d8d8a8348f8b227b7bbe13e97e721670
SHA1

00f009b6b2c65c3d8753cfdab18a04226ae94262
SHA256

d4e517bc0dcc71e4e2c06e25bb735c398fd687c7f1759ccc92945e3bda190667
SHA512

58c73542c2aaaee9e850c185100f44bbfe07185de007157b07032f2ce0d9e49ae71940be8c6d2068c5374a1e8567505aa8c1aa9cd094559c7e44f9037f308367
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFXpK5c5hIGt:W7ZppApBULcfpHLcfpyDA67Ig

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3438) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Inuvik.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Microsoft Games\More Games\es-ES\MoreGames.dll.mui.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\DVD Maker\sonicsptransform.ax.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp	d8d8a8348f8b227b7bbe13e97e721670N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8d8a8348f8b227b7bbe13e97e721670N.exe

C:\Users\Admin\AppData\Local\Temp\d8d8a8348f8b227b7bbe13e97e721670N.exe
"C:\Users\Admin\AppData\Local\Temp\d8d8a8348f8b227b7bbe13e97e721670N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
48KB

MD5
98991f03dec025b2b8a9cf0d26068990

SHA1
047f5cd265ffb92c9f51f0e21000a2dfb136cb9f

SHA256
660942fe1f63fcc6087bbed5166eee908d085c0c23711911d8bd59c1edefbdf8

SHA512
a86016ca15f1e4c54d73131f50ddaf5a812b80d0cb5ae097eaac12ffe346eaf32801c8349b885d8b13067587a18344cfaa4d36013819480e9d64db281f2eb055

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
57KB

MD5
122481afe969a53ce5f7ebc27e40e9aa

SHA1
3cc14d5d19151092a9cc4673ab44e876c303d552

SHA256
83da7c771d777eb44bcc92751e9ee6bee5a73eb0fd2d47faa6ee3bc54804a291

SHA512
8831fd6d15b771f6af2046616ac2ab108391a91835e65623497b71755cac0ae87368b4c2dea7b3608e4279f664d7eeb3994c41b07b8e7a578fd6ae168d403db9

Download Submit