07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
Size

83KB
MD5

50640036a8d8562787a7fb1da087855d
SHA1

699881f512880374f15428acf9ac99e75116595d
SHA256

07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3
SHA512

6e00fca3d70da038e1de2c34faddea0a5dd5ced8a9e015a7677ffbdfa70d9d2b15ef86456bd0fff3088bc682079f7abebb9b82a7f5314db49befe0a3826481f5
SSDEEP

768:/7BlpQpARFbhNIiJwsJwwnZ7N1J3DCl4N1J3DCleWbWYskK3eaUkK3eaQN1J3DCK:/7ZQpAplJwsJwwnK6YskK3ZUkK3ZK

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3470) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_dot.png.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_rest.png.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\cpu.html.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jre7\bin\sunec.dll.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\gadget.xml.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_floating.png.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jre7\bin\splashscreen.dll.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\highDpiImageSwap.js.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Noronha.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\timeZones.js.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)notConnectedStateIcon.png.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novokuznetsk.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jre7\lib\jsse.jar.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\47.png.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guyana.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_cloudy.png.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\Java\jre7\bin\java.exe.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe

C:\Users\Admin\AppData\Local\Temp\07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe
"C:\Users\Admin\AppData\Local\Temp\07406ea5740b463189bdc1befb7f1ba443efb779fac8261a9db9d0dd3de978f3.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
84KB

MD5
f00ee36e5b213616a7d83c29e719d8c9

SHA1
e02a4c416432c9f39d85b33cc4d9ce1ae9efe953

SHA256
73c451acb9d1e3b1af232ae735d0dfe079c6067326b3105b1b99795d25b198a9

SHA512
b050b808ca9cef65764ca239f7650afb6a65354ffb597f7cf52e295f325dc4e6f36f0428f25c12f621d646daedf786342f448527473363df781738aea470d129

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
93KB

MD5
f04c5e18080276cdd57813577a83dd5f

SHA1
93b30a79cd053517080bbc0bf47a273b122c7053

SHA256
81816259f74e120b142a7eca2ead5375a09694d3b69d5cb6d4af828f4f7d94ca

SHA512
c01817c9708de7a8206f8e8bbbe934788dba4447ef9d3098236929ceee100db63d17bafc7de35d390230141c80a264b97ae2da4827a7053e289180810ef3c325

Download Submit
memory/2168-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2168-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download