0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
Size

53KB
MD5

1d8ab6535ec98220ef6a9644d749d490
SHA1

d63c798ef68c6c8914f9584722bf1a22fc22fe7b
SHA256

0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1
SHA512

ad1fa1d4066e3efe4358691e0e17154a751c7772cb6e89c4c8622aaf02752f5d4fefc3f885aceea61366c14dcd6140a01fb9afa515cfe10b09e3beb94d9f01c9
SSDEEP

768:W7BlphA7dASbSjJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c5FpIci1xupIci1xU:W7ZhA7dABJJZENTBWv367WrCWro

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST5EDT.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Zurich.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jre7\bin\jp2ssv.dll.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Inuvik.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jre7\lib\jce.jar.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Internet Explorer\Timeline_is.dll.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe

C:\Users\Admin\AppData\Local\Temp\0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe
"C:\Users\Admin\AppData\Local\Temp\0c7ad117190f1510708ee7cac9a8e3a95a4f74f80cad142b6410d3b8023ac3a1N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
53KB

MD5
989ef017e0b6b32bcc2748082cd20b69

SHA1
856d8a5f6117d1c5552b87ef3d38735076ece125

SHA256
56e08675149b76485c997a7b977d4b5434cc36a1bac06f1937759db82d75a460

SHA512
17b8556da30b6251105e4904e0f8edd5633624379a992706ceb24f56d8fc35a1977c2345490ecfa0c26103c5040e4152bfb496a577c0bf9410810bd8c7289e78

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
fc9425b0a61cac8790e17d76670a850c

SHA1
1df39497eacab01b2a2963d9e57175e67f0a2450

SHA256
b1621332a18fb976b63abad3764d3daba9e4befceacbe44e00cc15779df69213

SHA512
1fd6dc451d465e23638d5b904ab9c8db63ff6b5f138ecc2f1757f3382926cbde00694683c315d25b77223c7b631f773e37a66e738fa86ebda32c26934d469ffe

Download Submit