dbba965c06e3b61600fe11d1dccab8193b940caaa5ce109028c7b7815844e697

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

806d1380900f45c7a06794ffcf2d6f50N.exe
Size

48KB
MD5

806d1380900f45c7a06794ffcf2d6f50
SHA1

ec8767e459d4426414b4c96ebf4503c1b7343b7a
SHA256

dbba965c06e3b61600fe11d1dccab8193b940caaa5ce109028c7b7815844e697
SHA512

ab82856adbacbbbcb83d45485d4f204a6f89ec0759635bb5b81ecb204647be01201ec82473d0ca50d6f8c8a202899ed0654b3787cd854dfc8025342b50d1da12
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFXpK5c5khwRDThwRDiu7uG:W7ZppApBULcfpHLcfpyDA6swXwD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3250) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.common_2.10.1.v20140901-1043.jar.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\RequestDismount.mp4.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Ojinaga.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre7\bin\zip.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre7\bin\servertool.exe.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.tmp	806d1380900f45c7a06794ffcf2d6f50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	806d1380900f45c7a06794ffcf2d6f50N.exe

C:\Users\Admin\AppData\Local\Temp\806d1380900f45c7a06794ffcf2d6f50N.exe
"C:\Users\Admin\AppData\Local\Temp\806d1380900f45c7a06794ffcf2d6f50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
49KB

MD5
9a1328bbfaa7c439b402fe30737ee25d

SHA1
f8b26bc86e98bc6cd7340c2919bfba1069171aea

SHA256
603d3554b9e5d1c6f610988215b8f309ce18f73b001d278633107338226a0d66

SHA512
00b5591983ff90f543b0076c5263c2e66249191d7aafe7fd9e63324c48cea01e950fd656cdff6b8edf2696352d85045e76c12d332e0fd170e23838765cd6bbd7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
875df4544aedeb384bd1e6f5a61c9f23

SHA1
b86277c2980f098c9325f2fad11f0578ea8d6609

SHA256
bba3097471f5ea8b1dd0e177f0f83f58ed949814a8123a059118630cc15858c2

SHA512
722c781428c55c78f722d466bd1c41d1e5c8c5385df55446270f9df00c823af12e0b81cce1d1e7e89aaf7215e84b48668a68cb4565e9f2b663b41b6101312f5a

Download Submit