Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06-08-2024 08:46
Behavioral task
behavioral1
Sample
855938396ac12639f7f547c64a9fe0e0N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
855938396ac12639f7f547c64a9fe0e0N.exe
Resource
win10v2004-20240802-en
General
-
Target
855938396ac12639f7f547c64a9fe0e0N.exe
-
Size
51KB
-
MD5
855938396ac12639f7f547c64a9fe0e0
-
SHA1
b9803c5aa065f3019ff7b6908ddb243ccec64021
-
SHA256
ea315a1c9f74780943dcb8aba0977c016abdaa2d9037cb05a4eeee24d937d2fd
-
SHA512
ee1c33b5e44775d3cac0e31182e10eec492fbf5989ca1e831854b892036c2678ea6bfa0015a2588ef7ad76b25322e1826964d977fd768cbccfb03407403ff6df
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzH:CTWn1++PJHJXA/OsIZfzc3/Q8zxF
Malware Config
Signatures
-
Renames multiple (3269) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1400-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x00080000000120fc-2.dat upx behavioral1/files/0x0003000000010330-6.dat upx behavioral1/memory/1400-82-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jre7\lib\zi\MET.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libgme_plugin.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kabul.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp 855938396ac12639f7f547c64a9fe0e0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp 855938396ac12639f7f547c64a9fe0e0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 855938396ac12639f7f547c64a9fe0e0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD52736767c52d152e534f93771179ed6f3
SHA1e7aa9d04314f6b989a96d0097d61b426fe03e300
SHA256d9407c7677334cb82f7076e76352897d3eca3509e229cdaebed62a7ba0f246c3
SHA512ac045e621acdcfda306ec8af17e7140fa5d93bb4200cbf9579bcd2932faeba3d163890e424ab260d2c07bbe5fb7cf827415e9b7d87671419324f40f1701fc23f
-
Filesize
60KB
MD504793fb5d80cb15a3009e88327ee2ec3
SHA11f344f5561200705241df3bc4bf3871badc49466
SHA256f23f32c043b9fdc7f4824b89fcec10c80c06f1be099447bb100a980120332598
SHA5121ca6a4c5e2c5faab17116c7b070c7697580ebd460a7a279313e90672ad19121d4f8ebe1a08b34f521db8379f8acf24feefb436778c31f7592d7ccafd9047de6e