07be98cb300bed20e1096f5fded106e8be339f003e9a3a1a0930b47f65b34e20

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7d7c1a42b36841849227ff31de932db0N.exe
Size

49KB
MD5

7d7c1a42b36841849227ff31de932db0
SHA1

f20c12e556945eb6c8229b1edf4242d0437172af
SHA256

07be98cb300bed20e1096f5fded106e8be339f003e9a3a1a0930b47f65b34e20
SHA512

a03f8d084728e97c99e4bfbe59653ff6e9b10dc17c00a6b79af2ab4e313c27bdb0dd3f09b1050709e661babc0cc6e6928ccb14691a5d6cab5fca41761ba4280f
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLmuH9uHxjzj+:W7ZppApBULcfpHLcfpyD9uH9uHx3C

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3424) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Edmonton.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\VideoLAN\VLC\New_Skins.url.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsftp_plugin.dll.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Toronto.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp	7d7c1a42b36841849227ff31de932db0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	7d7c1a42b36841849227ff31de932db0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d7c1a42b36841849227ff31de932db0N.exe

C:\Users\Admin\AppData\Local\Temp\7d7c1a42b36841849227ff31de932db0N.exe
"C:\Users\Admin\AppData\Local\Temp\7d7c1a42b36841849227ff31de932db0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
49KB

MD5
7ef2c299ad60ae480201bd326eeb61cb

SHA1
6368cd07b215a2eb4ad896e4878fd85a1ab5b1ac

SHA256
cc89e95c9d67617d490161d182176e11baa4682cbaebac1622e8b4ea3862b2cd

SHA512
42b01c3b6aeabd1e5974fa7ec41f84836f7b079c060771e24d1b8855da2a66ba109a3cb994b0de1322f49778e1275496a416284e5f17a0d07ead9189daf182e6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
4eeed6dceaf0ccaf24c7f9cec27baff5

SHA1
2deae420133250ece3990f144c88a72c6ea94e41

SHA256
ba5ecc1bd85407efde013cbed5654c3ed38a30073724208220b79c9a89e0aed3

SHA512
d241362ad2d363a5c168d2f54fc299ae615e0936e01d3222243d69df54fc80b51b2acc75cd48b5fcff839117843ec398645064b1b4c24ed0365c177a4755052d

Download Submit