Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
3bac1e505e53a665629fb2a478dd8eb0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3bac1e505e53a665629fb2a478dd8eb0N.exe
Resource
win10v2004-20240802-en
General
-
Target
3bac1e505e53a665629fb2a478dd8eb0N.exe
-
Size
44KB
-
MD5
3bac1e505e53a665629fb2a478dd8eb0
-
SHA1
407471b68a5a45f70b0386cebe706caaa4b0276c
-
SHA256
deda002460cf7b60496f9dce9d38f3787f373a4782ce75aeb482034ef72ba899
-
SHA512
c2322e155810641115f79425bc7c765d6b31a789b50a8aacd3c2820c8611ff155ff5e55529fd91ce66fc15bf240f6c83064bee8eb7cf661045742563546e3e2f
-
SSDEEP
384:GBt7Br5xjL9A7AgA71FbhvnwR/s4Nkq81LOyq81LOUqKqeUYyIl3yIj+NQKZX+NE:W7BlphA7pARFbhM0Kkq81LOyq81LOdoc
Malware Config
Signatures
-
Renames multiple (3264) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Mozilla Firefox\install.log.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jre7\bin\awt.dll.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jre7\lib\calendars.properties.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vienna.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Sofia.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Edmonton.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jre7\bin\dt_shmem.dll.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libau_plugin.dll.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.tmp 3bac1e505e53a665629fb2a478dd8eb0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bac1e505e53a665629fb2a478dd8eb0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5dadc1e4bee90ee7f10bc796b0de4ec6f
SHA1e8a62803b8c05f2b6cab9256fd16983d19478d3b
SHA256fe3f159c7b5e279a362b1a0b1eae56a4377ad0866594175cf1d529399a028836
SHA512ec11727218884a94a68104f53b2a751e3c7b7d7991789f813d9afc9efe8a0a25de1d61fe08bc3202ce819e0663ea994ac4a25bd841acb3532ba559db709bb700
-
Filesize
54KB
MD5de0947cf7e75c937fbc729e2625c231b
SHA1b2c1d683e9805e5440775d2ceddb6914a66af941
SHA2565b1bdbd2bd2ab4dfe08ce6755f9ab4f67b4cc76e8669a25231648c35b1cb13f5
SHA51224b050e446fc092c6752350513f7034bcdc29f8771e841fb32cd92c73e9af2ed3fbbbcc8c9145e3eaa2380844bb4e958f104632006c207783f6a8ccd08eb23a1