Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 02:56
Behavioral task
behavioral1
Sample
c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe
Resource
win10v2004-20240709-en
General
-
Target
c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe
-
Size
62KB
-
MD5
54399835ce84a02ffc07283a456b37bf
-
SHA1
ddc64fd3aeaef3460e2d9f9361cc85207a9a79f4
-
SHA256
c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0
-
SHA512
556a90b5258a97c1fd4027aef907e47786fd5497640201898756822ec1377ae328e4d3ef051f01074cd1b9cc7e49d84faf9d0cf7210900a0e811a8013443742b
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBZBT37CPKKdJJk:V7Zf/FAxTWoJJZENTBjTW7JJZENTBD
Malware Config
Signatures
-
Renames multiple (3460) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/3032-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00090000000120fa-2.dat upx behavioral1/files/0x0002000000010486-6.dat upx behavioral1/memory/3032-650-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\ast.txt.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\VideoLAN\VLC\skins\winamp2.xml.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Microsoft Games\More Games\it-IT\MoreGames.dll.mui.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\VideoLAN\VLC\NEWS.txt.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Windows Journal\ja-JP\jnwdui.dll.mui.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\AssertStart.png.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Colombo.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Windows Mail\de-DE\WinMail.exe.mui.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\CompressConvertFrom.m4v.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jre7\lib\zi\America\Edmonton.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Mozilla Firefox\precomplete.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jre7\lib\security\local_policy.jar.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\CopyRestart.jtx.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll.tmp c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe"C:\Users\Admin\AppData\Local\Temp\c0788839a8b3dc11be8594717385f4568fabf84e4df431ae47cd49476db3f1f0.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5752273975fc3445c36be844cca2f0e3f
SHA1fee07518d97624eac885bec59a93d77a881bd3a8
SHA25696faae3409eeb25897768432fe0b90a3339d1637f07f8895bb8050916927e9ab
SHA51297f1913583b2a9b9c7a7ad7f0e031f314f4cb7365577fbe87622647bf8fdb8a4baa0da9825d6b10422160cadab795ff34bc97c36ddc13d637b2a2c942f00797b
-
Filesize
71KB
MD5943b8c5336d4bc5473265b7c21e7dfaa
SHA1eca5c0b43fd7b027ad5d0a3cb55ffc32e0bec7c6
SHA256cbad24c90b081fa6fedc1c225b9c04a17d1a4f0587e30109c0021300938bf229
SHA512663f89aaa5d56d9933e1aec83a6ac3563f319decf60f00190e3f8146fc1b1b2e5520e72be61d7346e4aa260bf48b0d83ed37d159582408b81cd5ca95f0e0695a