dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
Size

80KB
MD5

79f9f24998ec553091ad4cd17e3ac98e
SHA1

0661bb3d3800b704a6f4b6e4bedb59a8611cc295
SHA256

dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4
SHA512

cfa2a43ac2af1b5abfde0694f6237d659d8bd72c232cf0c024e939cd98f58d7c4f6b87f32739a8e51b625cae463e078a02d05ec4b3270a842112c936d61a5af4
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBCNW+:/7ZQpApze+eJfFpsJOfFpsJ5D8Q/NW

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3515) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\meta-index.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.dll.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libchain_plugin.dll.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_dot.png.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bogota.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\RSSFeeds.css.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xml.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\St_Johns.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Windows Mail\ja-JP\msoeres.dll.mui.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Manaus.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Windows Journal\it-IT\jnwdui.dll.mui.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\picturePuzzle.js.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\library.js.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jre7\bin\eula.dll.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
File created	C:\Program Files\Java\jre7\lib\resources.jar.tmp	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe

C:\Users\Admin\AppData\Local\Temp\dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe
"C:\Users\Admin\AppData\Local\Temp\dbedae2e6e60dc17dd64326f2b8ec6d5c5e6e0a642a0431596ba520e2179e7a4.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
80KB

MD5
bbd383822fa0334a53cc9e20fdfe2887

SHA1
828df767195f2417c7c38a3f0faee0b4c8ef8065

SHA256
3af5bbd14b52119ee6ed5d0070691d3321fd0b8947fa076ef27773dfd7c33c86

SHA512
cd799a4f4608b226214b2a7570ff4ae604c329a6aa3a10904498b6836dbd762281500c93943d1811beba743177f4df0f2bd5aee913a27c2fb89ee479b9ff12ec

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
89KB

MD5
554cff1574891c041a8b148ccfde91b3

SHA1
fa2a3eac3e80b7cc4b67dfffa06b61d34ced8aaf

SHA256
3125dab24038cce182ad71834dfee1ca8d7fbaaef030d8e9dab29f2204a565ba

SHA512
ea7287490af4aff8d8c78af899f8a52da68204b72624923e56695fa24e6fa24823369c4babffd2bd0b7e32390370ace7c3dff58d1a2254a9c2ebeb3301f6b6cc

Download Submit
memory/2808-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2808-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download