121e6d7aa1795f37936e297b119adb12a5dfd6a2c5b915e47f4f752eb4a95289

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cfa95cd174241c3a719e246e0bf9500N.exe
Size

92KB
MD5

7cfa95cd174241c3a719e246e0bf9500
SHA1

80477eb4239e5e5b44500e50fdc12e8b08166d80
SHA256

121e6d7aa1795f37936e297b119adb12a5dfd6a2c5b915e47f4f752eb4a95289
SHA512

a850ef2f2993b1a60ce343f7d7f08a1f4b4432b21b7698d8467a052bd3dfc910c43ac4bc6c62317e29a1cdd9a24d9c0556dff455e6e645a9b15c80d3eea677ab
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/HfFpsJOfFpsJa4X:6e7WpMaxeb0CYJ97lEYNR73e+eKZHfFM

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2917) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jre7\bin\fontmanager.dll.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4ADT.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jre7\bin\wsdetect.dll.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp	7cfa95cd174241c3a719e246e0bf9500N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cfa95cd174241c3a719e246e0bf9500N.exe

C:\Users\Admin\AppData\Local\Temp\7cfa95cd174241c3a719e246e0bf9500N.exe
"C:\Users\Admin\AppData\Local\Temp\7cfa95cd174241c3a719e246e0bf9500N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
92KB

MD5
694171f1db6f2177c080ac5121b9420b

SHA1
438f1835d5e68077401801960f9b756cb8f1e8f7

SHA256
2f68ef1784778e9b8491d2996868402da4ebb13c5b70c08fab4719be3c0d1c7d

SHA512
c24151a217038ee0a125b118b2c4162e6e9b6925e1977d776cfadb8cb98e9709351f726dc579236f42310c70e4eb35c72b5d57c3dee48ebc2073d6e8ed7c6b56

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
101KB

MD5
2c22bfb34bf029119ca46cf25e0a2da4

SHA1
53d7bc506f45cebc0b4bc68d3717141522d59ec7

SHA256
a2e532da500ab70abab5a55ceb4c1cd07712049a567a28c661e573266349df58

SHA512
7074f981ff4059b302a91ef38496ea29cfed5ba0baade916265f788e66b73a60cef69da080d553e7409f074c6dccbe6e1fa3fab06a3ed670960a60be95d2c690

Download Submit