7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
Size

82KB
MD5

8b75ed46bd066e1edef0010e0ade9c40
SHA1

3d12d0174d50a412a1170332d09adf51e827209f
SHA256

7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4
SHA512

df85c364a903a0e811832c1335b9681b405f1ea82d953b61d483d21ac9c8e2fd6c8cc94d081ad77cb597750d92b995b0b5a2d4d27f524d1a5ad8004fbba75ee2
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYp:6e7WpMaxeb0CYJ97lEYNR73e+eGGG

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3711) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wake.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.PNG.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.lng.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Windows Defender\MpCommu.dll.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Windows Journal\Templates\Shorthand.jtp.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_left.png.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jre7\lib\javafx.properties.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jre7\lib\security\blacklist.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\localizedStrings.js.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\plugins.dat.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\cpu.js.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jre7\bin\pack200.exe.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Java\jre7\bin\unpack.dll.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\gadget.xml.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe

C:\Users\Admin\AppData\Local\Temp\7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe
"C:\Users\Admin\AppData\Local\Temp\7dc09842a1683995f4159114fc097acd9705bd7fd684e7f7ad9c36d954c5eed4N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
82KB

MD5
068a4f437dcd6ac7c78279e60d8fce94

SHA1
72b9c94b96fdf859bc1e3f074278759a02cdc5d0

SHA256
71a65e5f35d79d49c6b8fc453a845862a232c830bda773e34a7cc76a5fdd08ca

SHA512
fb899f32c14181608349b9b5114b45233e0177748829ce213547e92fad431eb2cc136eb710849f54dae6fe88e4dc3795db660668fd6ccd7279d47fb59fe2e0c2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
91KB

MD5
f19914b4a68cd9af984aaf672c7f0165

SHA1
5b8521a877798830662837b005cf9eae1e27a4b5

SHA256
bc1c46622bf847dc749d8a34a7b939d7329a5e36deca3ba706a780ff370fce10

SHA512
ad88524300e31b4c42af7bdbe873a9f0487e3ed9c2937a5844d944c24cc34ac8e09effa65641b0dc65d499431b8d08f3874e9534ca84505af1474b78f144f1f0

Download Submit