b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15e

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
Size

51KB
MD5

af454fe7e98e7e22e9b0622abe9e8780
SHA1

c2197a478d24f46888512eb99f2e7ae6121e5bc6
SHA256

b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15e
SHA512

4c798c7e54703e8a29b22f60672e0ce4fbc8bd14ad80a87c7c55e296b90a7b7b59f83a5250d8797a3f78775b2dab7c04baaf34abd936db10f22cc0340d4b80fe
SSDEEP

384:GBt7Br5xjLdbAAgA71FbhvU8g0U0fL+8t8YwTZ+kZsAZsuXq:W7Blp+pARFbhBgnKL+8t8NZ/Xq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3155) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Mozilla Firefox\install.log.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\St_Johns.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jre7\bin\server\classes.jsa.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST7MDT.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent.ini.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe

C:\Users\Admin\AppData\Local\Temp\b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe
"C:\Users\Admin\AppData\Local\Temp\b7b10194581315bcd77c496edff603f6b385ef1dcde3bd78dcf46e365dacd15eN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
51KB

MD5
759c7ca50ef8c1306b73c38466501800

SHA1
5ea31488b1a02198e9696c9480b7782106b0abad

SHA256
c8dfebe29af3012627cdebbace8384c6514df77fc7941eef43c072a865586b42

SHA512
d6bfe0de64c4be967254b5bd5c70f954701439b2040e0ade206920cae0c7913cf0789e9a36d1e4923027effcafa55ea077414c3522b900ee41436100a190f235

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
60KB

MD5
6a58f3c0add903712f58eccdd828dbb5

SHA1
4cd4fc1bcd8cae81f3d88ac44693f231ea456f89

SHA256
55a6922cef301bcbd864c2a14a7299fa5325442dec3d6e392fc7a495ed8d7dd5

SHA512
906fb1d14cc0d29c3e9f66a2b0d004455c4d24b36a377e06743ad07aba81d71e57ab6693b16b362504ec2c6bcd3ee73fb159076c100fe8de33701fb57d3b4448

Download Submit