Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-08-2024 10:29
Static task
static1
Behavioral task
behavioral1
Sample
85a6685bfd4fccecb5ebcd0d1b6781d0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
85a6685bfd4fccecb5ebcd0d1b6781d0N.exe
Resource
win10v2004-20240802-en
General
-
Target
85a6685bfd4fccecb5ebcd0d1b6781d0N.exe
-
Size
107KB
-
MD5
85a6685bfd4fccecb5ebcd0d1b6781d0
-
SHA1
560909fc6d7353b36f42291137c640860462f374
-
SHA256
be168f67a3292b5bf4513d5dab17ff95aba5c438493df76eecbea62e012b83ab
-
SHA512
a08f4c89787b26cbb896e8cf6f10e6ef45a97f735dbbd5e0c956eee0b6794886f44e89906b739b12ec28e9f6031457b4e43e11ad35995ba48f166f0567198fa8
-
SSDEEP
3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBg:PqFF2Ie+efsim2T
Malware Config
Signatures
-
Renames multiple (2884) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-cli.xml.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Internet Explorer\Timeline_is.dll.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85a6685bfd4fccecb5ebcd0d1b6781d0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD55a52d9c76c5d17231589eaf2a70eddb8
SHA16376df020c225732333ad30cabf677972995da54
SHA256fe0a5a65632a8beb59db01d24a3e2ce367a3b45cbaeda59a5c03aa15b58f8e25
SHA512feeee62366e845ccff88a03ee16d3b5319dfeaced79bbf87149126fd527fd18d3159eb64249caa03e90d0b235c57577bff1fc2376480ea02e0e6eedea768686d
-
Filesize
116KB
MD574beb4d5213d2ae5be7836da1c14e921
SHA1f618f865aecbd6197971bf6e73f4861dc5c6544f
SHA25630dee18c4a5a3e036b233566318fad8ec702e35771992a2632bd8cba0c1dff2b
SHA5124c5d74392112b8e017ff904d85f39818043de6af4823e56a0308d5085e68a6e390418e23533506ab7ff24ce182498090806b8c5a1af1260a09267dd82a6f2544