8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
Size

97KB
MD5

e3201ceae213f2bb976fe7f912b61dd0
SHA1

9a7eb7081af890bb59ccc65398baf74e03fd26c6
SHA256

8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514
SHA512

78425fcefbafed246ec0ef96d8f758291fff30db127aa94c846a82a172aac5679fbb90c55b399d8f52a177abc65320a742e99d44402968478907446be339c822
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBQ:PqFF2Ie+eFb

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3100) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Mozilla Firefox\libGLESv2.dll.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Godthab.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jre7\release.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\EditComplete.vsdm.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml.tmp	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe

C:\Users\Admin\AppData\Local\Temp\8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe
"C:\Users\Admin\AppData\Local\Temp\8d9d3eb299352e6e1a5bd57cc7efc813dbb9d530b5d4a129a704207b5284c514N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
97KB

MD5
c98f7e15c6d1402cb3bd26978fe4f088

SHA1
fee24ca5edb05da215b71f22363599c1e63d2125

SHA256
9a8485e023958b7e9e3b191cabe872ff9da34f2dc7340a7d0d9e079555852d68

SHA512
51bc30a9efe08434707e2f89354cdd7e4edd445f27008a9a9d4cc40ab0dea73f73117e357d51f6c3219800b7d424198c6760469047395d4f06be47ac5bdafaa0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
106KB

MD5
6283816718d90c3f103a1e76125e71ee

SHA1
3c2d1c166cb4b165cafe3714a18b077debc1edbf

SHA256
c311031e2da7c86eccd73a683123b019b321caff59110e367f44e3f39dda312d

SHA512
9463f1b19b283353e04f235d2b3d3e15eb02cadeb8b3e48eba51e0902a4bfd358b45c70e497c9ed1cef06b2ca119161c349d3df004c68d1a67f710af9549c1de

Download Submit