7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
Size

78KB
MD5

be15bc4bf729917ef607672415adf900
SHA1

a373fe8452d39f3149caf42b2dbc11340f3115d9
SHA256

7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430
SHA512

9747b6c7374a68f32cffdfc051176e39c15f7d20781bc4c70e212b8b93eee7dc031b86221455bfe86c371e55bf17a6744502fc98e9d236921206e2db1f437dbd
SSDEEP

1536:/7ZQpApze+eJfFpsJOfFpsJ5DVSWu0SWudVl:9QWpze+eJfFpsJOfFpsJ5DVSWu0SWu9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3141) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Mozilla Firefox\mozavutil.dll.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jre7\bin\zip.dll.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\JoinGrant.vb.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tunis.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\DisconnectNew.xhtml.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Dublin.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Mozilla Firefox\updater.ini.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Internet Explorer\Timeline.dll.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jre7\bin\jfxmedia.dll.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jre7\lib\security\java.security.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\MountSplit.au3.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ashgabat.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll.tmp	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe

C:\Users\Admin\AppData\Local\Temp\7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe
"C:\Users\Admin\AppData\Local\Temp\7407aee22f6925c23c117925dca106c49d51a2dbdda8192cd9ceae6250f0b430N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
78KB

MD5
ee640f6314434010a224e11c63d57c7d

SHA1
8095ef53285945cb1924911f49d1e44f6dad4c43

SHA256
7185eabd28ae14139a500d8e954f5e6954666e2924d48e9d7a06fb3db48edea1

SHA512
546a1d8f191801a9a45f2b07affd3c80b5b91c2c93e29c325c23a39c6aa47ffb19b2bdf5b1e7b8017cb1ddbd1ef29b7a933787e312cdd399c7a0526ee950cbb8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
87KB

MD5
3f75517de4b7725d64a69c541765594c

SHA1
3dc979c1dea11d6b8a4603aa1bc566c4433c3baf

SHA256
49525a2fbed214db3d1c5a0a7a207af79c6ebc7b451cf1fa9c6aa9bfb7e455a4

SHA512
4a16e4d055db2f5092727b4ebc9c7a0ddad4b317a9fd03411eabe4989a8bff988f02db8816c513aab5801e3e58081bd09accd5bb26124cbc1265be6d9c6df475

Download Submit
memory/2340-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download