7b67da1243ac4a19606455bc49147c64fc2c5955a0b4c10853eb5848f9071b1e

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79382659c18f04135af689aa97c55870N.exe
Size

145KB
MD5

79382659c18f04135af689aa97c55870
SHA1

6cbc6b6eef8fcb0e9b6c76e77b48f1f9751a1699
SHA256

7b67da1243ac4a19606455bc49147c64fc2c5955a0b4c10853eb5848f9071b1e
SHA512

8588b8ae0ed1dc9051a359ad7a9755011347faa3a65ff078cbff74312f7998cd831213c3e8b77ef410884399c978ae7461c2ae2b56762770efff5d3390412a52
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7f/e7WpMaxeb0CY5:RqKvb0CYJ973e+eKZOf7fWqKvb0CY5

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2790) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST5EDT.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jre7\bin\unpack.dll.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Internet Explorer\Timeline.dll.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Mahe.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	79382659c18f04135af689aa97c55870N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp	79382659c18f04135af689aa97c55870N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79382659c18f04135af689aa97c55870N.exe

C:\Users\Admin\AppData\Local\Temp\79382659c18f04135af689aa97c55870N.exe
"C:\Users\Admin\AppData\Local\Temp\79382659c18f04135af689aa97c55870N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
146KB

MD5
a4adcce29bf209168035c4f9821e31e1

SHA1
a22bcde2e6b54f18e3b697eb7b6db73edeea9110

SHA256
f06962a26ecc893c0d30a239724ea8a42bb5219797aaef09cc5b2362e2dac8db

SHA512
f6fdba6b940e652eab0ad2977a36a7735fecb98961e47d3c1d0557b59ea07145c3b8b787a0d8f45a029f0c001067d4845b71975e88785397693f3f9a9e5dcca1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
154KB

MD5
ea342ed2ef75fe578c8cf3af633d92e8

SHA1
a0d772211cc90b7de793a3ddb05e4a96cce3ec83

SHA256
f2b60d0e8b79c3ec6210a55b7a11b18ac377c8b0158f41a7681a8a64bc398e23

SHA512
122555461c20223a8b9f69f5ed07699d33bfaf034aa7b74dc50aca7c9ec4069850d3bbb4e826f5c1d7fa7cff2325a51bf9974057dc2859591fc1bc9d67027c13

Download Submit