bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
Size

49KB
MD5

dae54ced0343cf1c32743d43236aca30
SHA1

bcc205a0c2aae30c1b5ef8d34f31de650ac153ea
SHA256

bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25
SHA512

6d7239903f19e6236118d79860a452e539628d8f9f2363437558d179cac93be5b8c82ab945810107e61460c20199499cf1ff4e7a88fa18104aabf7b39e2b8548
SSDEEP

768:W7Blp2sspARFbh5YSfff9n1oXKCqzEIn1oXKCqzEy7NqOJyjqOJy2:W7Z2sspAp5YSfffR7NDgDX

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3242) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kabul.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jre7\bin\dt_shmem.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\management.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jre7\bin\ktab.exe.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jre7\lib\net.properties.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jre7\Welcome.html.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jre7\lib\flavormap.properties.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server.jar.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar.tmp	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe

C:\Users\Admin\AppData\Local\Temp\bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe
"C:\Users\Admin\AppData\Local\Temp\bd8011044e66a04ee28da89313b8e2f34bb8e3d9294b146891af4528007b1d25N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
49KB

MD5
48930ae60d89505b1f7f4b9cf53b00d1

SHA1
177de86ea0f73a6c8a45102570ec96ec5bc460bf

SHA256
e84e55ded0270f39ebacc78a466421027eab6180704ae8c39d6bf522dea8d1c4

SHA512
2091eb3af5a41fe8b76f86b6e047e86f70e2bc731787d254dbd27993f57a9b7384db3f194b47f7d00dc8308f7a9d509adae86f332541713d816f437e282a06b3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
8a1374a1600d70f4fca8c12fc8f9898e

SHA1
787786e89803953e28d175c3f3ccfc4135dad688

SHA256
18461f6879686641ac13aa884f05908074ec9f3991a1b5af3c3e23fd0845284d

SHA512
91461a362e031941dfb1772c5a1c2cf67ff0c4fcfce601c71eb486a183c1cbb96ac53b8cfcd651a936e4bbd9e33baab15222c76af6ae3332777655610915f866

Download Submit