bdf9a6e2a68ec61be32c0bd2a1455231b2aaac0f92f9d10daa31a1dc29b2d9b9

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2e2a297adc6511f3d0c166991254a7f0N.exe
Size

96KB
MD5

2e2a297adc6511f3d0c166991254a7f0
SHA1

884aca836ddd81dbfb742328ce79232d7909c2fa
SHA256

bdf9a6e2a68ec61be32c0bd2a1455231b2aaac0f92f9d10daa31a1dc29b2d9b9
SHA512

113c095ef10b4a498f7fe6bbda75a9ab93663ffa670115cbc269889f26b2fcc9fe953d08c876118ae3e42200a07224ed7f95d8835404ad810a93fe1988144e1a
SSDEEP

1536:/7ZQpApg9u9rYmdC4cq5AMaBikyJ+s6LiU33:9QWpyu+JDIkyJXU33

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2953) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy.jar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e2a297adc6511f3d0c166991254a7f0N.exe

C:\Users\Admin\AppData\Local\Temp\2e2a297adc6511f3d0c166991254a7f0N.exe
"C:\Users\Admin\AppData\Local\Temp\2e2a297adc6511f3d0c166991254a7f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
96KB

MD5
5383d6c0591fb54d6622418751544888

SHA1
c77f95f8c8680dd8591588f8b14f826abe0bd022

SHA256
ce0a4622f9d949b62db7d6b38e7a7a0449815131e8ee6fcebce71b870d86a99e

SHA512
1311eff5c8b44bd9d96b7b43d1d2dbe0267e18adff6d6b5c90eff2e16ace8df8ab8e09118e638ac67fd0595c885e6a06019cf9b8094bfb7681f55ade57c00972

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
105KB

MD5
e007190c1135a44c39d2645e1d45b7a5

SHA1
634a2e2e5893b3543d8aa5c2c0e17e64e5e98442

SHA256
0a2eec62a99788d07f15661833be02ef8f42790abeeffecab99ec32083cc1271

SHA512
f395db05815ace71c26e9f9f1b2ae68ce0c677053d099011581a349009cd18c0768cd0685f2487ef9dcd0aa5a30e2f8229b1073167f931eb658c44e7a207b15f

Download Submit
memory/2552-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2552-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download