4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949d

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
Size

34KB
MD5

b33fa2f4198b8f6166f3f6ab2bb6c960
SHA1

3dc8c108bfcd6fcf8f7dc8ba7ac763ea6107e140
SHA256

4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949d
SHA512

9024c49b418bd2262b799ec8ed135e876ebb2d06430176305e191c4ffe1994cff71aab9e1b58928f1d8933564c547c7c52ce2e3d6626cd2aac46c4902406f8ba
SSDEEP

192:tACUADIY0Br5xjL/nznlAgAQmP1oynLb22vtI0zWXPXVz7jZjLx+:GBt7Br5xjL7lAgA71Fbhvt3avjZjo

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3452) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Mozilla Firefox\removed-files.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\bin\dt_socket.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\bin\javafx-font.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\bin\management.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Christmas.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\bin\fontmanager.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe

C:\Users\Admin\AppData\Local\Temp\4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe
"C:\Users\Admin\AppData\Local\Temp\4d00bedc9c9363795f03a28dde15431398a1664e073d1bbb410e20304d87949dN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
34KB

MD5
4441adde41c18d8a07dfb55e918f54b6

SHA1
a65b81f88ede4de848a20388a8baeec551b6f88a

SHA256
13488009ca3b69e6d354ff089a4be1919366661d39bb0f4b9c74f051c1b51129

SHA512
52420a787b7130372df5b4efc470131ffa5c06e555b3bda1a607d63478f5b8fa42f6b9c7802cf12171b33998d5e3a23fd160834763477cc0bd4113f2708eca99

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
43KB

MD5
77d32746a044a1110c09de5b1861d5ae

SHA1
676eae82d31b52fa5da1eb317be4550fabd00316

SHA256
d5b0780c0431a42595a4fa91c44c17457321b22079c17c24c7d58d6c752861fb

SHA512
5a17dcb75ec9d16f5aad113547e4fa86fecb3d602251591c5efcb604a108a06a27a0603d8a54a6448002aca21366114c3383068c8d2aab411841c66898e51d90

Download Submit