3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
Size

38KB
MD5

293de79e4ccadb7e4d3a4b01ae3b5c56
SHA1

ad40b2dc5ac4cc2846f23a3526559e12582f5c71
SHA256

3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b
SHA512

4f49f951df0771e7b5b9d1e9215f467994c1f7cb1f4230ee7c0061fd0572340b54216067f818f66e97691aed1536d9b93e5c03ad1fc73a501c474d4564db0bcc
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSaP:W7ZhA7pApM21LOA1LOl6vSs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3663) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_ko.properties.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\clock.js.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.png.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)redStateIcon.png.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Journal\it-IT\PDIALOG.exe.mui.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\library.js.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.jpg.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\gadget.xml.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.png.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\cpu.js.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\RSSFeeds.css.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\slideShow.css.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\weather.css.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jre7\lib\management\snmp.acl.template.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\VideoLAN\VLC\AUTHORS.txt.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\gadget.xml.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\cpu.js.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_bottom.png.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jre7\lib\security\javafx.policy.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif.tmp	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe

C:\Users\Admin\AppData\Local\Temp\3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe
"C:\Users\Admin\AppData\Local\Temp\3872a906544d88352fc4ecdb4c6208558c7df898cc60267c939cca3f10a2d59b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
39KB

MD5
39b0e73d20ff2cedb1ac48907d9bb3bd

SHA1
4a7670c44706ffa0eea060255c7001cc7b7f7ed5

SHA256
00e0d5a9f42e438e54d71b060568837410f9de194fc039e521ad46359cfd54ca

SHA512
cf0295821709238b7c7beb6286f13b336d4fea085f49844c92f32c062416a1a7cec5b35110a194d15bc37289ab8a90e7b4a00c2357322ff7e312cefffffd5d18

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
47KB

MD5
87e6d64f2c7688c3f7017b6bd3994291

SHA1
44d1291a10269b9bf585d7ba09e06443771b3c5a

SHA256
20a2363ea9729a86788e917e6793ff2ac0494f5ff9c49e82d1660c6401c5c661

SHA512
908f81873116eb10eb776eeec3f0316c35ee9f1e35c3054abe967d75805c2ab73cdf98d687afaee62b879c564f2911f48846ed4f9a37468bfa749023040ba663

Download Submit