7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
Size

50KB
MD5

079ca090fd286e3a70943704716f4192
SHA1

89aaba3ba1900c919db124f35ae830dbc18a7160
SHA256

7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d
SHA512

90d08f367597d6a9f7dc7e2b8cdc0cb8a071d9a0d3a752ec7ad08d52ee46da0902028f241a4e0ca868f78e23e4c66d9c49f140e9da7a522e284211b09c8ef1a0
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFew/DbAGw/DbAXoVRO8iJfoVRO8iJ3M:W7ZppApBULcfpHLcfpyDoAI96wXwG

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3733) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\flyout_background.png.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_up.png.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\28.png.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent.ini.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\ChkrRes.dll.mui.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\picturePuzzle.css.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_rainy.png.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libhds_plugin.dll.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Windows Journal\fr-FR\jnwdui.dll.mui.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\redStateIcon.png.tmp	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe

C:\Users\Admin\AppData\Local\Temp\7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe
"C:\Users\Admin\AppData\Local\Temp\7b444f473799eaa25d4742ed919ff0a6cb31a2c4c5d62203f784ab5a7f36ed0d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
50KB

MD5
7869153a59c5fb0d655e465cbf14b86b

SHA1
4929206cb0980287ce692ca7d0ccfddb35390aea

SHA256
088f357e85cf48d7b24cbfcc7e2d04c7bfdaa96f26991abc1f3437cc88d4cebc

SHA512
3b407182b49fd9498fdd45b4de5f97c588996a761b4f5df8c1b21c28cb1c415de2afb96167b3f86689a51bbc33cf83d7738681c1fc3b1faca5d0004f385f231f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
1f3458dbc33fe345e1c8de0843cdefa9

SHA1
3bf65021550a6f6c0cb088b947d64c14c7e83099

SHA256
2df2bfdcfee375a25b468b73113ac8f4387c95ee9c6756c2d5a10401b3f55a11

SHA512
fe2e688c1379f85065a145b13362e23aa19cb0d4fdeb2238fe94547c7e511a17e3eb38647eddddedb92bdc677e70bcf3f99b7dd9e867821757f13a5640d6f194

Download Submit