9207c944badbd1547cd71e7d6cd5996557fda509cddd1b7f666fb4f964f012ae

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfdfc58ce97ed02803d035287f125dd0N.exe
Size

56KB
MD5

dfdfc58ce97ed02803d035287f125dd0
SHA1

245f2e4bcc72a486d6483aed802ad818cb316209
SHA256

9207c944badbd1547cd71e7d6cd5996557fda509cddd1b7f666fb4f964f012ae
SHA512

07ae2c14928675e95e7ed2f8ce4576031e5dce99eb169222a00cfe72ba33a95b53eff51feffa88b5b1a76130a63866fb9266c03250b789499843502e60838563
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcSoxomMs1MsE:/7ZQpApze+eJfFpsJOfFpsJX

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3261) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jre7\lib\security\cacerts.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-execution.xml_hidden.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp	dfdfc58ce97ed02803d035287f125dd0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfdfc58ce97ed02803d035287f125dd0N.exe

C:\Users\Admin\AppData\Local\Temp\dfdfc58ce97ed02803d035287f125dd0N.exe
"C:\Users\Admin\AppData\Local\Temp\dfdfc58ce97ed02803d035287f125dd0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
56KB

MD5
c778be8e1c3a57d3a5a712cf990bcbbb

SHA1
8ebc4944aa1b4244670c3796dda774271f12b4dc

SHA256
389b51269586f3459ae233dd0c68c4372b41eb3a47e2e4c5467e3bef7e6ddc7e

SHA512
4fa9815d4b7eb1058fe88e51402566d1c3ed21718c80ed5578c227077701208ac995d6de848dac0380b5fc54403d27cd45c135ac5ce64bceb996f3a97d1b75cc

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
65KB

MD5
96abaa90cfa90d016b71d85fddfc19aa

SHA1
bc6b3c622805483c8faf88e0fa512331cd633f7a

SHA256
cc49bde2488a8080b19ec127f6345d1312678bb32c7bbe5c41eb7463304c6222

SHA512
aa0fb13401f83bb8e7f4752eac21ce49be427c683242e06505268cc7de9f8305e30f53f62bffc9c28402dae964527bcc168d6067f3d44b4e8bf6c71c2f554d80

Download Submit
memory/2508-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2508-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download