7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
Size

41KB
MD5

fc80bb637ee8f255d61650b898947a5b
SHA1

6e25278fa3ed0d2eb012efbccc04d6216c51c5cd
SHA256

7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef
SHA512

4545333fe7d24290f9668ca2c6751aa132f0fff43e6627aa2012cc4049d4306e9bc857c920ced0cd822aeba2a7d22937926d10e09b63cd7920069638a1d4ff72
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lt587edqdv87edqdl:W7ZhA7pApM21LOA1LOl6AC0l

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3792) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\chkrzm.exe.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Windows Mail\WinMail.exe.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\highDpiImageSwap.js.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\settings.css.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked-loading.png.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Windows Journal\de-DE\Journal.exe.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.CGM.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\cpu.js.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdater.cer.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_hov.png.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe

C:\Users\Admin\AppData\Local\Temp\7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
"C:\Users\Admin\AppData\Local\Temp\7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
41KB

MD5
ac58c6790969e6749caa87d1fa45495f

SHA1
6aa5db16f5518011705658e2feb6fae911bf860e

SHA256
45bd85cf3e928545b4276f8f5d4930919000d39d0ba9f3dec7a6499e39b86c75

SHA512
49e303907de735314d10c9367e0606d503db9f57402666fbff117fdcb3a94cb822788f93458b905d66b92cc6ff52b2b41291afb89ed42cd727582c3778319fe0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
50KB

MD5
32a387b09b04cfb85798e37adb1cd6cf

SHA1
2adaf23ef9b2831030681ff7b27e04053e303e7f

SHA256
4029575d3af84cfc8baccb5b7e13d0db5f07d1b80cc9a99ab0a8d9eb47f83ab5

SHA512
72fddcf2e1ed9228d0188d9d5e3e72cf2fa912af7fe67c2e125fc66338042353745a38b033298be2d16713a67dd586990de3b041c7b29c6377c26f5fcb73dc94

Download Submit