4585313964ff51f3098f29d1b2dc0b5473114a12b952234b62ce28b2192c21a6

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d1de8150f819ed739984e56933aae90N.exe
Size

50KB
MD5

2d1de8150f819ed739984e56933aae90
SHA1

bdf91c94d7050128939472ad80eb4c00dfdfc368
SHA256

4585313964ff51f3098f29d1b2dc0b5473114a12b952234b62ce28b2192c21a6
SHA512

ad398527dc20c524695a8d1a798bf34a5364fb0dcfd407d5362d2ffe43ec0c3707f1fc00396cc3a3e5f0f815037211e7e73f345283be75915d0aaafe00da86bd
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLPCsZCsWbabN:W7ZppApBULcfpHLcfpyDEdL

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3259) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ReachFramework.resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tarawa.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp	2d1de8150f819ed739984e56933aae90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d1de8150f819ed739984e56933aae90N.exe

C:\Users\Admin\AppData\Local\Temp\2d1de8150f819ed739984e56933aae90N.exe
"C:\Users\Admin\AppData\Local\Temp\2d1de8150f819ed739984e56933aae90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
50KB

MD5
83a6a8a613eb4a0b16e0bf764da767a6

SHA1
876eadb94c9ba5da3f1cb2c09e6b6750925a63dc

SHA256
a45e2db56a5fecb53267a991561f853dd56be33f9523e7fe7278e91382edc250

SHA512
5b3a5291a272f7a6adf625754e4041310a5983a973d8d46941ae558be816a29e361065db16deeb14e88e71bff3c934031eedb7bfa65311ce86a4fffff0ac2478

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
20eaf8c6e0398910a4558cd14154ebe0

SHA1
dfa18487bd7b10eed068c135eb0a16b78a49ccc1

SHA256
e3cd2f46d068b55454460fda4dfe9aa029cbc3ba99227cabe734194ee12e9a1f

SHA512
697c6d18dac0f02961c6c6a041abd911d02835cd6ed9afbf22fc345e4ae750e4a1f835e5bf99501888e8eb73903bc7d66c694e3cc083411b754abe7141344538

Download Submit