e60935000eb4578d93c815858afd6f1222c7ba5db32636d6b3b1e3dc1110cbc3

Analysis

max time kernel
120s
max time network
14s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
Size

82KB
MD5

7fbf2a8ba90c8d8ed31fefc567b995d0
SHA1

fde5725a37930efbb4dfa3eb45b56d71b595a488
SHA256

e60935000eb4578d93c815858afd6f1222c7ba5db32636d6b3b1e3dc1110cbc3
SHA512

3c674e4b4c22a6752edbf3e5b0144315d815aa4105a5cc20fcca4bb135a976ed16c1548d4a5519107dcd8ceeba727d876e94608d2c582bc452443fe94134bbbd
SSDEEP

768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORRef:W7ZDpApYbWj2WTWJe+e/qXhgT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3108) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Chita.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\desktop.ini.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\DVD Maker\Eurosti.TTF.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Mozilla Firefox\install.log.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7fbf2a8ba90c8d8ed31fefc567b995d0N.exe

C:\Users\Admin\AppData\Local\Temp\7fbf2a8ba90c8d8ed31fefc567b995d0N.exe
"C:\Users\Admin\AppData\Local\Temp\7fbf2a8ba90c8d8ed31fefc567b995d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
82KB

MD5
0f4820adffa31044536bb618524791bc

SHA1
d6086dd0b77c108bbc9a5ed9414c92ce188ce91b

SHA256
92b43c7177b09dc4c59fc7e7ce6dab49ff7f36fe18127fe749edaffc380f653e

SHA512
1d1ae4acb9e75008247c35468c3f7253c8e8a40401cd4763cc670a60ab24282966428047446cd540651110d10e8af5ade64b4d75f783c4933a0bb957d4ee12e9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
91KB

MD5
ef6f42786f0aae4563fc2f3d9faabebf

SHA1
698a24df59225eb6e1acfc2045278464eadd985d

SHA256
6e4820d1544e3dc771a2a61f1c5759d219ca2835a6a839e0a9a71af6a01f286a

SHA512
27d410e24e7c0355368ee86411bbeb90df28b3e61886df9edd4563c8731c91209abf2728ee325b43cd5dcb4130fb00e72d9d7c52d5382efadda0d316b1ce69db

Download Submit