7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
Size

49KB
MD5

c60707bf9d843772077a7a23af61f7a4
SHA1

65c820fb21e1aef628780b32cfbc5afdf7e5fb38
SHA256

7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d
SHA512

aa81ee9ebf8cd6ffed61bfb5b7d1b2fc496e5eb22bcde7a6bf4da4c0bba9b67f13ad63a5bcb461913551f7a96f60989c5261a4409564030160218b2a44534f5f
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJwRJofJoToY2yAJSFyAJSzyAJSFyAJSV:W7ZppApaJofJo8Yy

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3796) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mousedown.png.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\flyout.css.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.CNT.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\tpcps.dll.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Windows NT\TableTextService\ja-JP\TableTextService.dll.mui.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\NamedURLs.HxK.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jre7\lib\ext\localedata.jar.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jre7\bin\jfr.dll.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\12.png.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\AddNew.tmp.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jre7\bin\keytool.exe.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-down.png.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\localizedStrings.js.tmp	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe

C:\Users\Admin\AppData\Local\Temp\7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe
"C:\Users\Admin\AppData\Local\Temp\7dc32fd20b2a58524cfec23fba0725ad3938081a2adb231cdfe79fbb6e390e2d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
50KB

MD5
816597cc91bb092be256170a3abeca30

SHA1
b1d62bdf07dbbb7637d2adb5af2d4fedbf57ec56

SHA256
2062ee92c41be00b023caa4795856822c67526d160ef4a2ed80e70dd4a91752a

SHA512
89004f9031eadc075688373d26b682b315df2e8872ba78a2e6665b693f4442954a0021d3855c67d54ed1dc667dc51853fde5dba7b843f3a0b8860c29e0ee04b4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
819e637b808584c9ad71df9d26b200a1

SHA1
ad48a47519c5adb06139dcb185143edfb31942c6

SHA256
4216ebcb09928556af88fa77668309c449cef071fdfb3c33fb39e2e6eea93f78

SHA512
580c7acb8426eae3a995e90e8bee9649449285e1969301c8d889197f5eaaffa9317febf40abcf8982c79cc330d8b5a1c960a634df47ced2730ec8bcd69eb19d6

Download Submit