b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
Size

38KB
MD5

09fd94e94e0552771121744f58fac8b0
SHA1

7ee2c8319798a3ba194fe5d858a257532e237567
SHA256

b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01
SHA512

73f423b82fe18c985c7c28919919b67dce4dd353667b9d3f27407c814560e188dc2d4e7b86f295d147d92f68701b7197895a657673d0ffefe9936689f200518a
SSDEEP

384:yBs7Br5xjL8AgA71FbhvsDYcUYcmzazIRb:/7BlpQpARFbhsYcUYcwRb

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3434) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Internet Explorer\F12.dll.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\vlc.mo.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe

C:\Users\Admin\AppData\Local\Temp\b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe
"C:\Users\Admin\AppData\Local\Temp\b07fbceebea75f96cc2a8a3b5f99c80b191cdebb0d43bf5b0d2aaca87316ab01N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
38KB

MD5
0b92c4359bdf311c52fa54328a1fc87e

SHA1
f5848aa74d79d561cf9a51698db0f37e8d8d062b

SHA256
3419778202a324b9f77703be6891e315b84c01ec0439781d6be6046c6dc43735

SHA512
4c987ee8224e03009b5f60b90a2f9d8df05a2457f428b0544768a01fbdf56368f32c9744c77d777d451b0484bdaa5f0eaa54f009936ef5b988a8a674c1952b9e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
47KB

MD5
b7d4904d962598affb53ac2c980188b7

SHA1
82508bcd25b86ec150d6a7ce2ed7b071995741bf

SHA256
f39a1d66934566d6d3ecf038a0d222639b327665caf79dd1aa695c7f4d4f505a

SHA512
0fe5604b5be4a790e1c1bd979e98af1bb7f8a68b3f435cbbc3e7e225c25024eeab3cdecd55a3edebbd363adb977458b1322b00c4683e747234336b8da0dfa00d

Download Submit
memory/2268-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2268-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download