079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
Size

45KB
MD5

db23bbe0c588d2771177452661de1b63
SHA1

a14263741054773f0b29de6f023eabf9afd89423
SHA256

079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a
SHA512

5a771e7616e0ebc2d2c15de074c847c13f5c7f13f5e29d79f6364ca41ef56f90c15de320cba4f6fa6bc40e633baf725a94f8d2e1a505681c2eaec5097e2cd608
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyLlvoxol:W7ZppApyVyjVyLlX

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3143) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Mauritius.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\vlc.mo.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
File created	C:\Program Files\Internet Explorer\perfcore.dll.tmp	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe

C:\Users\Admin\AppData\Local\Temp\079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe
"C:\Users\Admin\AppData\Local\Temp\079afb8c3a759c5abb83e309bfb63f078c05941833e4059402c0f32f64dbb82a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
45KB

MD5
0f386a4c810a1514f5c9cbb82f9f8978

SHA1
14096e69b7c5d950360bb6a228374f425a5f3aed

SHA256
cb03c3cfcd674c0bb2bb717a8450e8999b3f94b18a7caa00334e0d312fecaa48

SHA512
a5e609b1fa59646483f042bf52e62322491b32442750d87daccf795c00a78ce8e80854d94e2a82201de628cfb1b5fc0447c23b8d86f17941667107fe4db0fd65

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
d2c4dbef9194cd5cfacf72fb140eb22a

SHA1
5ef50e74283df2a8b0982d934b3dbbd400c59d8d

SHA256
b46dc0f4b1c0e91d6bf9fcc551b799a0f04920001ebcc7566150871f996fbec5

SHA512
8a5d437aefd0897bf70a5626db25d82ef17a01d5744666c370933e28bf233639b0fc17ef21a04c34bf484aab6df66c084dc9f6b7ded4482cc381978cb5579c02

Download Submit