7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
Size

54KB
MD5

a977aa35317bd7c69b1962471beaaee9
SHA1

a1b44a0e1bf95f5dfa51ad30a250d67f2db27b55
SHA256

7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767
SHA512

13e5ca0dae5d72e3018e6a061b179d84b67e537ea430263e97b43396df9654b0f12b222a0e0c0a8bddb918150e44fd3c3a321da70278be0d0e251bb793b8a204
SSDEEP

768:/7BlpQpARFbhdS5c5mRawAlW1VkRawAlW1VCkOROM:/7ZQpAp86MLkLTAp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3787) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_ja.jar.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Vancouver.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_s.png.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\8.png.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\calendar.css.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-middle.png.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.CGM.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2native.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\logo.png.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\RSSFeeds.css.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEWSTR.DLL.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\28.png.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe

C:\Users\Admin\AppData\Local\Temp\7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
"C:\Users\Admin\AppData\Local\Temp\7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
54KB

MD5
71e8eef7e66b18a6af758147e442c18d

SHA1
8ecc06900cda6e9a2ca4d4fab153994ba47e1f01

SHA256
d9768e5215845994f98ad706f2f42c145e6f4c30200261d098c2443c6fff749d

SHA512
28fa8e38371152e5def400e38a8d340090ce1dfb76634d6d83b708fe94294afa0c474524ebf1b63da3d6a31fea7e2a38ee17618b9e4a62c5908e7d8a8bb134a5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
04a4ba840673784ab02f67c4e0c0a9a4

SHA1
471c6aa8f28b3fa90f4bbdb286b6d0aa7fe81409

SHA256
32bf0f0b96776b65fa038344772d685774d84ff7f72a4cd4c6f891d8c7f76764

SHA512
ad70b6b4214e65c26a022c3e539e59ec2a7e65c18aac75034a82041871de50c9ff68317e0bc342ad3c711ceefb4f168a85a686c85389d578700715cca5c69047

Download Submit
memory/2408-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2408-662-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download