0b1f4fa616b430a231cd57f48bf5db87329b9cd6abdfec9faf5a5737cd65ab00

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d639aea6f41cdccd25824519a62ff70N.exe
Size

85KB
MD5

7d639aea6f41cdccd25824519a62ff70
SHA1

3a11ce6e3431fef372f66015ae21611d2d1aecc4
SHA256

0b1f4fa616b430a231cd57f48bf5db87329b9cd6abdfec9faf5a5737cd65ab00
SHA512

b68fff1ce80acb8ed6eea8314fdbf5121cb328f5889860135ec62b8a4db2905f9ebf2d3ece5aae796d871d6991d65b61834eccbac27758aa9c46afbef7f7ceeb
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhT:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs6

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3168) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\bin\rmid.exe.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\bin\t2k.dll.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\ImportClear.emf.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Louisville.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis.tmp	7d639aea6f41cdccd25824519a62ff70N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp	7d639aea6f41cdccd25824519a62ff70N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d639aea6f41cdccd25824519a62ff70N.exe

C:\Users\Admin\AppData\Local\Temp\7d639aea6f41cdccd25824519a62ff70N.exe
"C:\Users\Admin\AppData\Local\Temp\7d639aea6f41cdccd25824519a62ff70N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
85KB

MD5
890f931e2c2ed998bde7c02b8f8ba9b7

SHA1
d264f53a7b3cc3d0a9eb9aaeb5f3ed80c998e452

SHA256
58f735e59294664e5c9f1c03e911863714a1a3cff0094fada891ad8bb7377a85

SHA512
645be7450d73696f6a30525d58e1488f4a66dedc97b8ee26267e8fe57d8f59fc8e0c11caf2e0ad6eaaaad110e5245b8489d2c2b55f6dcbae4359d7b0826813b4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
94KB

MD5
36fa39d3b4e50a88edc32d41ebc96ac2

SHA1
d36be16fc5b5417abc6c1c342a03f87b7f23d295

SHA256
09ad043d8c57fbf650b04de3791dde075d47ce7397fdec34cd11505a1ab871c4

SHA512
724e1dc399c995a75519ba8f529bc6f5a4a40143367197ff31a7d2dea3c88b3cadd2cdb15286ca507c0ddcf7e9e934c925f7da78a8b4f23ffa9e07cbab2a2565

Download Submit