3169661540c63bb0df3aac43fa484c5fd19e6d617e94962402de65ad70b62171

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7d7ff57c88fef40d001fd2e1cd09400N.exe
Size

77KB
MD5

c7d7ff57c88fef40d001fd2e1cd09400
SHA1

0da3f717541e1c4ca367f295eccd3baf52dd5aa4
SHA256

3169661540c63bb0df3aac43fa484c5fd19e6d617e94962402de65ad70b62171
SHA512

e369602e1c212072350ded7842000e165fa2a8f1721a003fedb17f1f4bbb7c380ad968caf2250d67b1734620ba8b7fd6722f895e1edff0e7104e844fc9161e5b
SSDEEP

768:/7BlpQpARFbhWGUKBb4JxobNlAGAIUkUX:/7ZQpAp+KBpbNiBIUkUX

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3268) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Curacao.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jre7\bin\policytool.exe.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\Chess.exe.mui.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\VideoLAN\VLC\libvlccore.dll.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Brussels.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml.tmp	c7d7ff57c88fef40d001fd2e1cd09400N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7d7ff57c88fef40d001fd2e1cd09400N.exe

C:\Users\Admin\AppData\Local\Temp\c7d7ff57c88fef40d001fd2e1cd09400N.exe
"C:\Users\Admin\AppData\Local\Temp\c7d7ff57c88fef40d001fd2e1cd09400N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
77KB

MD5
c22999ba71ceb78b12b7ccdb01b875e9

SHA1
902e78354d468e02655d482e9c78c21a6555be15

SHA256
b346008b24d2ca08c35f40edbf916cd7c03f16b9aed8fed002407a2a2eae0d7e

SHA512
8196f7a8624ba362b844973584e3ec71d2347c253bfc690649104f46d991ce7133f1b39899650f7d7ae61ec58ae7eae3b7ca2f85725467171e53e5c40ebba00f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
86KB

MD5
df6fcf6ea10a8623ccc6113ae4825c68

SHA1
aa4e6ee511048b28f999bebabaf18ad37c8c4e08

SHA256
ccf298bb5405902184d485ac777fdc4f283bcd1e92f4f8aa918383a39d3f3f87

SHA512
a0d1802dbf30a5d534ddfd67c4b4235aa989c3903fd395c5f44ad154c630c421ab75fddab94ecb4285d9f2ac1cf4806822ca7ddb11b4522c24031bc0c7c2b6ef

Download Submit
memory/2628-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2628-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download