Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 12:49
Behavioral task
behavioral1
Sample
9312db1a4e7fbc4e2a05c9d0c81b9740N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
9312db1a4e7fbc4e2a05c9d0c81b9740N.exe
Resource
win10v2004-20240802-en
General
-
Target
9312db1a4e7fbc4e2a05c9d0c81b9740N.exe
-
Size
50KB
-
MD5
9312db1a4e7fbc4e2a05c9d0c81b9740
-
SHA1
214edbc25217a97317150d5f2621e971d4e5a28c
-
SHA256
9354624c558b619ee507e593c1e97fe2a096e24ef674d1ad219d882c05a8ce58
-
SHA512
5b394c3079013a2f4c6ed80a024ceadea558b7a2f7191462803db2c109eae1bc5ad0a1807b700e61aa3c335d8dc506a3bcf4ebcf89bb917fd172f59a0ad1eb3e
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9H:V7Zf/FAxTWoJJ7TN
Malware Config
Signatures
-
Renames multiple (3115) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/3060-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000700000001211a-2.dat upx behavioral1/files/0x00020000000104da-6.dat upx behavioral1/memory/3060-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jre7\lib\fontconfig.properties.src.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe.sig.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\DenyReceive.wav.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Perth.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Beirut.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9312db1a4e7fbc4e2a05c9d0c81b9740N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5a1a8d0594e1d9eb1c637170854cacf05
SHA1419ab66ef02bc4501d2c7c54319d74550bac2ae2
SHA256fa74654b7a6e5e97a245e99aef11ca29ab9e8f29012161b4a4521726088c8d8a
SHA5126825db2d2682064eafad833f013a847544da719f4a9234fd7d5da70a5487632571351250c5e94525a5938c9302bf6680fecaa49091d1b989ec2662f014c1f68d
-
Filesize
59KB
MD560e9007b9b2631f49c5e5816504bc2c7
SHA156d8c9f698cd7cc6bae9e7ee28d6f48585770177
SHA256a9f6ead29da4841f8d2618376a163ad5434282eec571bc6ad7f305eba75c6605
SHA5121505b88ac1f7a5e50ee536690b07b544ab3d2f4a2a38c6fc7203e0a915883ce5410a4b68f5ef921223604f56c73fd47ced5cf3380ea4de8b5fdc8f7b45307452