6d8c8b383cf428fcc96f913bc0c43bd2e925461cb5b0137938638de00d54a770

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8e809b352e3fd4f136a24aa20a1beb0N.exe
Size

89KB
MD5

b8e809b352e3fd4f136a24aa20a1beb0
SHA1

6e7b2f181870cb9fe1b826ffd6f78ed3f76cc5b0
SHA256

6d8c8b383cf428fcc96f913bc0c43bd2e925461cb5b0137938638de00d54a770
SHA512

ae88ffd2bf993eda715de4b841b86a8c7908b436535274aec2aa1371b62b59797da6340b78101beec5f105f61162cbe4554e0ceff5387f0a16811ddc823d5f87
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWSYERY:6e7WpMaxeb0CYJ97lEYNR73e+eBSWSY1

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2849) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Berlin.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunec.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jre7\lib\security\javaws.policy.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\MeasureNew.mht.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8e809b352e3fd4f136a24aa20a1beb0N.exe

C:\Users\Admin\AppData\Local\Temp\b8e809b352e3fd4f136a24aa20a1beb0N.exe
"C:\Users\Admin\AppData\Local\Temp\b8e809b352e3fd4f136a24aa20a1beb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
89KB

MD5
0ecb34d91ce4782b406ca5157cea43cf

SHA1
23e22822c105fb8c578ba523c2dd04131f3a29d9

SHA256
4c7b13640b573acbdf6f2d3e32879a18e83c8ddda5cd291fb85ce03258dc35c0

SHA512
a54f03a0cd8e36c3b1f07c8698029ae6f13dc4e3a1955a585761b1d1cb70808774a12e856c32480c2d14965cb03bce2a61c34299276924029fb4162d06c2e00c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
98KB

MD5
e2baea88a504d64fab7a38f073f48ca8

SHA1
c337544ac7515c1d8ef257e06a29f3c51ac223ec

SHA256
8657c1716b9f7e9d8abfdbd902a1f37ea559929bf6c5efe9eac6751961a608a7

SHA512
bd1dafec5254d562beac4e13709598e75e7af57756ef132ffa13f7fcf08d498ff843a1d8ad256cbd3db90d7c408ec33b62186cf0bf180c805f0b4ac6d71b38cb

Download Submit