7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
Size

48KB
MD5

f1576d399486c7c07394aa985b0e7200
SHA1

20a6c57cd71b71e28c917a95786142c81947208e
SHA256

7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8
SHA512

cee099de9c8321a87f302b7c7b7dc21eb2b865ad12ec8ddfcfafd5837256b2b95a723a5c69dc01a0b35014588e52ed46666d4520ce097eb04745fdbb433cd5e0
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw1VyjVy/3sY1YE:W7ZppApyVyjVy9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3756) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\settings.html.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Media Player\es-ES\WMPDMCCore.dll.mui.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.properties.src.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\StopEnable.contact.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\gadget.xml.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\weather.js.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_hail.png.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jre7\release.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\mip.exe.mui.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Paris.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Journal\en-US\Journal.exe.mui.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_m.png.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Halifax.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnscfg.exe.mui.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cancun.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe

C:\Users\Admin\AppData\Local\Temp\7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe
"C:\Users\Admin\AppData\Local\Temp\7aad4b55b326b5d3546cf5e3d8dae72306656ae67a51a0963632a76060a886b8N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
49KB

MD5
dcf6f4156312c592309bdf3b10443810

SHA1
31dd3f248f5f45fe6911074585638930ebf10b89

SHA256
c625bde78263e7b245dda66ee57560608e3967bf0cca37437f7e1bacb43e2e48

SHA512
587bec722494e2c63adbc7654733a88fc4805f5223b86de38f6f0996fa25a3d8f730ff5befc7ace9bfdb35e6dc0855d31b719e4924ef9986356ab75dcd48c6f4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
d0f7d728839de8340aaea3de9021141d

SHA1
a5e7da0c784199ce227ca29658a485999ec9f423

SHA256
3e09ac365b2f261614829360ebf0872c6fd9b0f459988c08afe513b12222c763

SHA512
6577fed2affd790587ab2a27320115a004913d2cd4e9322f224af7f1c9fe00e35ba7e8ed830c442626ec8599086df369fea180baa396c9bcadc6738b1e61fc0e

Download Submit