7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
Size

50KB
MD5

cb6f8067ede7a6b6b442c0aa6ab9346a
SHA1

fae618451dba628da4444dcc253fd5527ebbd8aa
SHA256

7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf
SHA512

fae52a7a50ab3ee98c5fe3d5b67e5244fcf5e7397587dfa6038bb23d1bf87b29e07025b2a72b557800a1101a75a13179dac2cffca9f3a9a6fb41387e33104d9c
SSDEEP

768:W7BlphA7pARFbhL801VvM801Vvv7PZaZP:W7ZhA7pApw03vR03vY

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3790) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\21.png.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Windows NT\Accessories\wordpad.exe.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Accra.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\micaut.dll.mui.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_down.png.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\36.png.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\mip.exe.mui.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\WriteSplit.wmx.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jre7\bin\javaws.exe.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jre7\lib\zi\EET.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_zh_CN.jar.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Mozilla Firefox\qipcap64.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe

C:\Users\Admin\AppData\Local\Temp\7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
"C:\Users\Admin\AppData\Local\Temp\7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
50KB

MD5
627fab5257afc754bce794205f520c4b

SHA1
a6f8424b6c53798e3c555522fc73f278d343639f

SHA256
b5d5cabf9ed568c2b0649a1bc01f21394d9cb921c0977ad8b7f601740d687462

SHA512
879f0b50e652b20d41a86b4cf2f21fa5b3a2838442cd19e743297815ab4b014442bf639b0ecfadfbfb9a94fb951b009739542741cc68f3496b86d819d5e622ff

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
b9ec3bd0f32c09287ac52f2fb38380d5

SHA1
d52c12111bf9ccba1efda420d2a98e93ac0fb527

SHA256
c89fd1efa8353ebcd692bf0ff700e46a5136af1dec721d31354ded5b42f6d2aa

SHA512
dd04c7bb2bad794186ca0e125ad3bbc121af96d41b8dd39d9e6810c61627e1d156e3fc7ae0fd75a0aaddb2f788996fa70896f1f18284f56f2149ee78dc1837e6

Download Submit