ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
Size

43KB
MD5

000b5ddbdea026f2f37d133e6df3f9e0
SHA1

4f03b8dd33e8a4994db07a4520c059a174a1ffe9
SHA256

ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0
SHA512

029d47e96a5b3fb9ba75b018e02f39d26a16b58b0451baf9a3408ca8d9a63648fd4f6cdb00411941d19d52e913f44490be2ef72340704180ca761714415abd1e
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LObC8p8CVT:W7ZhA7pApM21LOA1LOFVT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3323) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tarawa.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\com-sun-tools-visualvm-modules-startup.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Mozilla Firefox\removed-files.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Monterrey.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Catamarca.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe

C:\Users\Admin\AppData\Local\Temp\ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe
"C:\Users\Admin\AppData\Local\Temp\ebbb8761831a10811447c24eff637bc0b9eb6e95377136ef21c343c4471c86e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
44KB

MD5
46e4484aef4e28d0723213b985f82ebe

SHA1
dc11a170b59db56d5f81a63ba4b9feca0e4afbcb

SHA256
730515cb2c534cf0355d7b1c75898034ef8a412f8665fa5644db3ebf519193bc

SHA512
034f581b90341e793c333e658c123a9c960bab984c5d675cfb82d45e6e97a23be7c4ca61af7b28128ec385dc7a275483b90ea77722e7fe5ee93d3ad912f7d64f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
985a80d69fd1b5ff430891d8884d426a

SHA1
fd871b9a69042f187f8dda97e74bfc076a7fbe3e

SHA256
a2938c4ca4c88f5582427f3815d3613fb75042e0b00b4b4000b4c9d3eea00bb4

SHA512
0302e52e5c1b392ea5847487e150324cdd4daa025a2399542c05c3ecd3f998cc13e9a5adc794ab2687c8be92057c26781421ce52a55cecd202e02ee6130afe28

Download Submit