879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
Size

46KB
MD5

4ce3fc57edbdcc5d1c388d82c6f116b6
SHA1

408d36edfa1af6914efacc4191fc63f10c2dc112
SHA256

879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539
SHA512

007dba7024ea3ac1f1510c925f320fee882a2d9a6121cb260af02d12164a941c7f4542fd26a09b12b2eb8e47f4b03ea21483064862308e1b27c4c67c429229d0
SSDEEP

768:W7BlphA7pARFbhL801VvM801Vvv7cY8+c+fZ7:W7ZhA7pApw03vR03v4Yh

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3729) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\cpu.html.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\VideoLAN\VLC\skins\default.vlt.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Defender\MpEvMsg.dll.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_snow.png.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\15.png.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\notConnectedStateIcon.png.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_rtp_plugin.dll.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Journal\es-ES\JNTFiltr.dll.mui.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tunis.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jre7\lib\accessibility.properties.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-hot.png.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guayaquil.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\flyout_background.png.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ViewerPS.dll.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Flyout_Thumbnail_Shadow.png.tmp	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe

C:\Users\Admin\AppData\Local\Temp\879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe
"C:\Users\Admin\AppData\Local\Temp\879a144a4fe0c53cbf8c8b77ccf1a6a42d2243494ac0b1f627113367679cf539.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
46KB

MD5
f930b01f3552a65de6ff7aeb04ec6ad7

SHA1
6a608f6242dd712e9b77a4f64a9c68386f74822d

SHA256
458492c2d4006eb49578c35e0366e7a46229401f464ff2d72137e8935180330d

SHA512
205d333fd4a5b55d24f1d622d560f96a37b4b8de87c9d68b9cc4ab80e51684182ed53324acca66894952bf67f3ec1d001cf0c9de8e93b688478e64c02d3faeca

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
55KB

MD5
10982791bb0614509b66ae5dd0b4e647

SHA1
0807b7ddfea55e78be0d33469b34345ca0eaea40

SHA256
844963bde31bf1baa8d940ebffa44a6243ea28b010c503a5985b259591097db5

SHA512
e1e72b4495a45154b29cfbc23db76e62001bcb083724201ac0ba9c9458be69b3a5e93c12e30bb47ffdafa20b6c87dc6f0c6f196f52e004d3bdaa9d058e792cb3

Download Submit