7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
Size

83KB
MD5

80ac9757c801b0417847fdc400f9c030
SHA1

8f7756fc39c40b7d04c1c152b010072571a32a2d
SHA256

7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8
SHA512

5c09bdeb999dfea3ab585975d72cd654c94799516d6ba2dc4e9bc055cc5044748b02e9d103f48319e37e7b764134c6c7d6c0d1095f302607eb349723a4934d06
SSDEEP

1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGLtErY:6e76mQSohsUsUKDtErY

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3211) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Apia.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\management.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\VideoLAN\VLC\NEWS.txt.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Adak.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre7\bin\fxplugins.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Mozilla Firefox\install.log.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vienna.tmp	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe

C:\Users\Admin\AppData\Local\Temp\7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe
"C:\Users\Admin\AppData\Local\Temp\7c19416c456c6afe13869a7df50afebe1c4036f6b5e5e698c05ba0238841a9c8N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
84KB

MD5
a642c75007e369c0829f9aa76c1f89bd

SHA1
c573e07fe1f5552aedaf47b5631b94d06e15ffe7

SHA256
b836eaa10ea8a306a7cd3a50fc06fa1a35f516c8a11e63a51cc078a157783003

SHA512
69f09231fecad8115f1fc82c9928c156390d762749fa9ab9904263aaf1b039aff7472b7b1745b31e37710f2ec46ad5317224c74751359d4c631ac112f10dbc23

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
92KB

MD5
a1184b3188a30131f7659085688ae4f6

SHA1
54e1bdc933692c26a54b355a774580ef4b406c36

SHA256
90505382b8f442c4d4e309545df12c4c0b6d408e325883f1aeb68cd66903c039

SHA512
6d95b61eb3c4d139a0cb91213e8f7289172689d49d88501667d2cc4b5d08635824fbc8ea5bd6fee0b12ad0ea9a3d90731b60248db56e29548472209fa05f7ad5

Download Submit