d8a4b6f3ca2eee7ffe9f29db3eec4ac8178babf739f1f990c1baa1664f31fb3e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

830bbc11911386a65f969d88d7c2c290N.exe
Size

48KB
MD5

830bbc11911386a65f969d88d7c2c290
SHA1

3550a82e69c237d1a845085684bf0c00814eb37c
SHA256

d8a4b6f3ca2eee7ffe9f29db3eec4ac8178babf739f1f990c1baa1664f31fb3e
SHA512

81db767c820932dd42ca400845fc8509f6707241d39c6d2d678d76fe1cb0941bf123d59573a3de55b556adb8f6ce64702726635677f039a31626113aaa811b57
SSDEEP

1536:W7ZppApBULcfpHLcfpyDUdyGdynmpmN2o:6pWpBwchcwDsAN2o

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3177) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Sofia.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.RunTime.Serialization.Resources.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\InstallStep.ods.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre7\lib\logging.properties.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre7\lib\security\blacklist.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	830bbc11911386a65f969d88d7c2c290N.exe

C:\Users\Admin\AppData\Local\Temp\830bbc11911386a65f969d88d7c2c290N.exe
"C:\Users\Admin\AppData\Local\Temp\830bbc11911386a65f969d88d7c2c290N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
48KB

MD5
cf0ba313f3f4d12fb169765a41383d30

SHA1
bdc1ab201bf57a5138e7cb9797b7cdbaa32b2adb

SHA256
a57f6d57ab9de635d07dd3e51c2e770f3e1e814688f7043b1cdad370595aa6ec

SHA512
5c131f8ea43ef4f0ed0a1d51a1332278879422f353a09a964df78695b6b1b4a445bc38f1f80c9c703f22e8d7139f63263ec98ff7e970cc62390ab76c5e281ddd

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
57KB

MD5
6949e420fd1df8121070bc56c52cb891

SHA1
87b6278bd013afea5f787bc2c612db5b47eaca29

SHA256
d6ffd575802855881b38318695cb9fd53c82946ca9c852c1741859a1c605ea04

SHA512
ad8540d71242ba5165090a4ff254a31242f3787257ada837d452a2c987b8d9a6c8252fdb3027ea0421d48a89926b59446e6b1186e4e71b274e2cdf2d98320fba

Download Submit