beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
Size

49KB
MD5

94c2ad417b788f18906468c127185482
SHA1

026f7a9973c686efcd51fe1331978ed684ecdb17
SHA256

beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825
SHA512

44f11fd1ac71106f872110b912a9350d767c82fcc3009df86f562a938b8dfc062e093461825c372c781ca4b0d60c0670119f658a34c88e502fa2c03dd5c8d7ec
SSDEEP

768:/7BlpQpARFbhdS5c5mRawAlW1VkRawAlW1VG:/7ZQpAp86MLkLG

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3789) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter_partly-cloudy.png.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnetwk.exe.mui.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\RSSFeeds.css.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\gadget.xml.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nassau.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_pressed.png.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwjpnr.dll.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Windows Defender\MsMpLics.dll.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\FormatGet.vstm.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Halifax.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Mozilla Firefox\removed-files.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACER3X.DLL.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\GIFIMP32.FLT.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system.png.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\OpenStart.jpeg.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jre7\lib\jfr.jar.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe

C:\Users\Admin\AppData\Local\Temp\beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe
"C:\Users\Admin\AppData\Local\Temp\beee3bb83c3cc1aa3eda746881f1aaf8339f0efee0930e70ef747e1ec5c0c825.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
49KB

MD5
d51d8d088fde7155783cc03a370cad56

SHA1
fdb000ab47b516c5821da18137e51974221aaf80

SHA256
9cb0a4ea8e5cbebf0139c16988410d1576f31c2f56fe1d151c6e9707bcbf9329

SHA512
7dcd57dd70c0b4de3f802723b63f7ddf5b8d1ab706df72134434216c5ff3839466b5585af2044c5f74ed49155fa7065365477f563bba6739207e9bfface59645

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
4567eccfa31fcfe00bf567b33033dea7

SHA1
e5d2dd9e8c6d04896d6f1b94a84f3df8436366cb

SHA256
865d61fd33afabf7b6c3ec706dae03e2578b80be76435c809736a99a11c94942

SHA512
755f7d3402aa6ec00cec981ca90fa41de9e6806f728cfebf022955d1a72afe0d30f97f40b28037d11efcaef98a4e0c3fa6a206ffff9f16f6c0abafb2ff45f836

Download Submit
memory/2956-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2956-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download