2d3b52d583aaa335684f3fff62775475c48d485ca03b3ef68d1f3b1914a4dda6

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
Size

72KB
MD5

87bd5adbc7f992a9c94ee7fadc0e3c40
SHA1

ca061267b9ae082a95ebaceac852887481dd0fa4
SHA256

2d3b52d583aaa335684f3fff62775475c48d485ca03b3ef68d1f3b1914a4dda6
SHA512

2fa20a2387538c81e2f18eef3a5851e29448dbd22144f22a371e186c74766e1ef50ed0ef730a7658523ffe8ec425b1fabf8578ac13755d53e83fe6fc5936ce53
SSDEEP

768:W7Blp+pARFbhtlmlQ3y3RWvf+wi1x9f+wi1xBTCcX8vgCcX8vSd5hdx8i:W7Z+pApfGQ3y3RWvfmRfm9sKsSd5P

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3141) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jre7\bin\dt_shmem.dll.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jre7\lib\resources.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Monterrey.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\chkrzm.exe.mui.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jre7\Welcome.html.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Internet Explorer\perfcore.dll.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-3.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jre7\bin\dt_socket.dll.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll.tmp	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87bd5adbc7f992a9c94ee7fadc0e3c40N.exe

C:\Users\Admin\AppData\Local\Temp\87bd5adbc7f992a9c94ee7fadc0e3c40N.exe
"C:\Users\Admin\AppData\Local\Temp\87bd5adbc7f992a9c94ee7fadc0e3c40N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
72KB

MD5
b0731130c595f35016d562ea8a2d7a00

SHA1
38b51dd91ddaee907dcece5e61b64bf206a52113

SHA256
514d60e8b438221dfb263ee3134103386d22d3e2c27e39db05ae78f2a3851481

SHA512
a829f8a8a8da23cec9980369062a8ed31ced8dd96649ddb7be023be84c3709bf59cfd2e4d215297e51ae394ecf303ec6c480189138b2b9ced0aaeba3f787ac98

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
81KB

MD5
387349b3439b182cae645fcc6056cd07

SHA1
1da20bb68941eff0de1f9a15a07eb58280f79cfb

SHA256
0ed109f721e5f04fc3bcbec3c9799fdd69226121cdb9b6454f8aebceb0cbf41e

SHA512
2ceabe216f89ba20548a177ab7276e1dbd4e4238365a01d07f1ceea1432699fed49dda077edbc46912991e876343c1e37799a836ee6f8964deadefe1153e48b6

Download Submit