30bc8a53529e8fedb7bb2474981c436dd65542e6737c3876e30b3937bb287345

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e8cc55165c0977bff130b8af4d85d50N.exe
Size

46KB
MD5

2e8cc55165c0977bff130b8af4d85d50
SHA1

217e3397c52f07bc71b4e9d509014e2d49b6d344
SHA256

30bc8a53529e8fedb7bb2474981c436dd65542e6737c3876e30b3937bb287345
SHA512

c18c436b822a9666466cfce727b231eb61069feb3876c8c28cf4b52462dc5524b4f60b6a55935b71eee6f7838a49daea914ad893fb9879daef1c4d7934bb0e97
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5loox4EOtiDJifox4EOtiDJi/Vox4ES:W7ZhA7pApM21LOA1LOl6o44424441tP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3280) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jre7\bin\jdwp.dll.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\com-sun-tools-visualvm-modules-startup.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_es.properties.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml.tmp	2e8cc55165c0977bff130b8af4d85d50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e8cc55165c0977bff130b8af4d85d50N.exe

C:\Users\Admin\AppData\Local\Temp\2e8cc55165c0977bff130b8af4d85d50N.exe
"C:\Users\Admin\AppData\Local\Temp\2e8cc55165c0977bff130b8af4d85d50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
46KB

MD5
0b706e1d36be166bc40b7de5cd954193

SHA1
3e61dcf4a79613e16ad771bd0ffb7ad71fd6d70f

SHA256
9eb9bcc78f3914f34e19a5ea151493ddfc573367160679a1edc98be2500eb794

SHA512
113ad515241214cd41aca6fb9160e06b8bc4dabcf87a2806e7498d5f5273dc9ed9757841ddfeeff2568ef414164aa6fcafb8e50134447b781baca8ff32b4440e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
55KB

MD5
320f8608a0acdb9561bd4e7be8e71cb9

SHA1
292c25cba758d01dfbae0aff0efd7f2781ecbe90

SHA256
c4fcf4cdf0c99e3a9917b10aceee198c125f69ad705982db326df650fb913719

SHA512
e385bd8a749780b0dbbfa2e4853e4bea2492ad293e224b9d69423f3ec2667ed7062db25b5730f12f7a918ffa16a33f793d114113208193a128d9c49832491fb7

Download Submit