8ca8b3a9119be52148a55fed79f8e6729926bb50449d7411d78fba83fe338e2c

Analysis

max time kernel
118s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
Size

86KB
MD5

bd8f35fe43d8eb84829dd1ed0a7928b0
SHA1

67ff237a7e1da282a36b2c4a021ef204fb7c5d04
SHA256

8ca8b3a9119be52148a55fed79f8e6729926bb50449d7411d78fba83fe338e2c
SHA512

f0662bebda3094c112625bb1e11c17feeacf8cf3853dcdc7357112681276fcc102dc2af1a550dc6feac2fb4ba933163785700480f4f71af252bade65eab58c50
SSDEEP

1536:W7ZDpApYbWjIoPyPoLzV7c6Sh1Xtkkkkkkkkk545:6DWpm

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2809) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Microsoft Games\Hearts\it-IT\Hearts.exe.mui.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Internet Explorer\Timeline_is.dll.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\calendars.properties.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mazatlan.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\README.txt.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\bin\javaws.exe.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Chita.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET.tmp	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd8f35fe43d8eb84829dd1ed0a7928b0N.exe

C:\Users\Admin\AppData\Local\Temp\bd8f35fe43d8eb84829dd1ed0a7928b0N.exe
"C:\Users\Admin\AppData\Local\Temp\bd8f35fe43d8eb84829dd1ed0a7928b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
86KB

MD5
d3dfa96de26b8d8b003e332039cbbd2b

SHA1
ce2d38869a6fb7a7dccce44a7b3d6620d16e88d9

SHA256
b771cd0df8227a34f95d4e3297009ee85cd5c38cf0b77b77f43aedc105132f1d

SHA512
80e020ae4698a0913bfef26daeaa9357805f17c3d627730da0b5c81db09ee7a352e0f53c5e8a4f063099bb2fd175cb4492ae6c668addb816748b84ca595ff7aa

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
95KB

MD5
1ec52deec787ecd938991e57fb238da1

SHA1
b8a5e9a3d34f72b6478a30df2d9951e83dcb5e41

SHA256
3454e42dcc871f5721c1d9b6f4f7d41af20688ff524b5b277cb65dc76395ea18

SHA512
8f9a26b14035491fe3953696f238e0565ea4ddb8fe51282a5e514cb5d176fb03dfd6a8874c2213bf86b9b1e116136d5d893ee8cf67f670b340116c409f8dc53d

Download Submit