2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
Size

35KB
MD5

c72aab729a13b716e5c5d9d1faddb47b
SHA1

1658d38d1075b18ed0d27a1f948e87576022293c
SHA256

2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db
SHA512

e05f966a6578503964fda63bdd7c292012460e64a49c81010fc39815e9c0e7a428b463b1a72b36006a86d9d3fc3f0e0bb46acd55fde7e2af5b09bd4101770073
SSDEEP

192:tACUADIY0Br5xjL/FAgAQmP1oynLb22vuN6GnN6GATQ1nrx:GBt7Br5xjL9AgA71FbhvuNBN2TQ1nrx

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3729) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnetwk.exe.mui.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_disabled.png.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\settings.css.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxC.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\settings.css.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\DVD Maker\Pipeline.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Mozilla Firefox\freebl3.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Mozilla Firefox\nssckbi.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\desktop.ini.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Mail\msoe.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Journal\fr-FR\NBMapTIP.dll.mui.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_s.png.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Sidebar\sbdrop.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\settings.css.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous.png.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe

C:\Users\Admin\AppData\Local\Temp\2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe
"C:\Users\Admin\AppData\Local\Temp\2f7b001adba3dd67a1540ed6fcf7356befd2c775a0bbe63f1ae6eb2a3d1e97db.exe"
1⤵
- Drops file in Program Files directory
PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

Filesize
35KB

MD5
debc32170e13364badd5f94fdfe5c27c

SHA1
8993b8ae9e0c14f66a9b19f268968bd6eb9e68d6

SHA256
3254fe3c6ae55568ca0158c2f8b9677b256b5aa2a89bb0e878493823be36e44f

SHA512
7d60b74e9d056d426f9e240c99af627326659dd7e016350459e0b4f24fa8e877fe6d07067ed2102f2d61830eaec9cbd2148a6239b743393023a6f713fdeda523

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
44KB

MD5
0f9a70bc62a09ca97c86540c48ae3d9b

SHA1
1cd1f1b9b0fd92c8353ec0d64be616d4bf37e6f8

SHA256
2e573abc70563beaa43ab4f74b38b4eb4cbf7c130fe868f8335b78e263ceb966

SHA512
4c66ec5f7e0bdfd9f514033b899c027b78df2490c392ac87a5c00796684e84078592774fee33a7dce6a55170eae1d9ba52e132cbaace178314eed313e869e85f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads