88f8f20c1a177dff9d72dbb2487c4f449852bb82a5cbb41ac9ac4dcf3f0fa9f9

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2bb82a3d0603cb8c0130abb542470c0N.exe
Size

94KB
MD5

d2bb82a3d0603cb8c0130abb542470c0
SHA1

488989ee8d83e1deb615fc9133559d44cfa38ae7
SHA256

88f8f20c1a177dff9d72dbb2487c4f449852bb82a5cbb41ac9ac4dcf3f0fa9f9
SHA512

ca78d0ea6007a927035adf1cbff77e815924ff7b1d52f7520deccc522457081c3c7b06dbb078d8f52e247dca60f48175690c8a33ff04ea76ede732fef63eff41
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBK2LUf7XQex2sRYstRYs5:69WpQE0zUzXvYsLYs5

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3055) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Almaty.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jre7\bin\rmiregistry.exe.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar.tmp	d2bb82a3d0603cb8c0130abb542470c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2bb82a3d0603cb8c0130abb542470c0N.exe

C:\Users\Admin\AppData\Local\Temp\d2bb82a3d0603cb8c0130abb542470c0N.exe
"C:\Users\Admin\AppData\Local\Temp\d2bb82a3d0603cb8c0130abb542470c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
95KB

MD5
daee230b995ef93fd5d4964eafe0147c

SHA1
f1fb7165c6432acb68b60475cdb472f35a8bfea6

SHA256
5066c11c9147fcde55954d8673249983eb7a5c21e3e83421906bd3a129480ad6

SHA512
7f5c5b246d32754ac334be8e27bbb6af0397cf25022f9c99e83a59e6de4842781a6bb6347dd0930ee414ce3b52c5ff8f809c83616a5f02e9ca4c97a155276f25

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
104KB

MD5
9ad144ca262d6ef0b5878a04c364dfcc

SHA1
174da9c3272baa187d24a7051a7f293e07e3f421

SHA256
8c793c352e9590fa938fb4880da1f5893d05203807b40706e3ffe41c5dc4f7ad

SHA512
c48bf520437887dc31134fadf0d7c8f2cc3b8ac5970ac3d6b3cdbfe823c65729fe31b32adf33969ffbc2dbc543680a2b7a2e888bc1332321e2122ac2a25d2211

Download Submit