a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
Size

50KB
MD5

9cb13238789f19b78a381b652c246c51
SHA1

e9558da4642ee53fb72f94771e5d44a3987d53b5
SHA256

a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11
SHA512

0ebad03813bb4033b686b26d2abb8ae11c6184abf4d81b9ba63efd2f3b394626efd39ab4908b75445c485286fc99a7c799c384bf09833b7c73ca09852ce790ed
SSDEEP

768:W7BlphA7pARFbhvOsTKnKqtkYts0wuDz0wuDq0:W7ZhA7pApvOsOKUw1w6

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3794) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\License.txt.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.png.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfreeze_plugin.dll.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\cpu.js.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXP_PDF.DLL.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\micaut.dll.mui.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\HLS.api.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\gadget.xml.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Microsoft Games\More Games\MoreGames.dll.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODBC.DLL.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\mip.exe.mui.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe

C:\Users\Admin\AppData\Local\Temp\a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe
"C:\Users\Admin\AppData\Local\Temp\a720f9b79a47895d8e3dc8d2f033c961369aae065d44fb4f4c96c297923d4f11.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
50KB

MD5
01c4c6910780facb0c5a3007908919dd

SHA1
52a7d607f1cd400b22b23e23e5d80e9253a6b937

SHA256
3aeb86db31c9a9219fd1da66279c2ca5a1dcb971e7a8b073102f18bf1e888c32

SHA512
ea19de96aab2e327df8be24f296d1bca3690139563163450eaba1c1d04d7d44a8c35c7513d6fc16c23539f7a20bc4c4c5fcd6598c63db432b4fb8573e551e41c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
20ab91642770bc5cd5189a4b9cc88b81

SHA1
2880e7f65420e850245f38e0126da21ff602e7b8

SHA256
f183e5220eea1ab4b2b7809b0a9bfac5a1135f006e2221b082c974b4a4197e3b

SHA512
8857719df119dc2b44f194e2eb6932cb4a01e1089ddba7f4e88a6ef4b017334c5d92fcc1ff09ad4014973eb70cf6abd9817189f458c26a84835a53455be5da1c

Download Submit