Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
182520a708225d28daedd10116406130N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
182520a708225d28daedd10116406130N.exe
Resource
win10v2004-20240802-en
General
-
Target
182520a708225d28daedd10116406130N.exe
-
Size
52KB
-
MD5
182520a708225d28daedd10116406130
-
SHA1
c75b3d688ba200090ba7d70b914c2d55f936d5f2
-
SHA256
54bef597cacf1f5d826f943614e2fe79767c71b33b468d27322dd7fd3950bd63
-
SHA512
200de298e297e99eabf7385b917284718f288bbc0cdbb1047fdad5f5a05f6f64db3d477fb1557a4e66381c420f89baae6252a0c174c83aba387a85da49a66a33
-
SSDEEP
768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFew/DbAGw/DbACSU0SUfhwRDThwRDO:W7ZppApBULcfpHLcfpyDoA4WZwXwM
Malware Config
Signatures
-
Renames multiple (3228) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Microsoft Games\Chess\Chess.exe.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jre7\bin\eula.dll.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\7-Zip\License.txt.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Sofia.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp 182520a708225d28daedd10116406130N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.tmp 182520a708225d28daedd10116406130N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 182520a708225d28daedd10116406130N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD51842089f89ed69323b3643c281b1f2d3
SHA1ce13f4b885350a0c657c3ac97c6a84bcc62a504e
SHA256629421714d05b293e57bab66b608bac7dd37d665fac9f138acb8090b0e6791e5
SHA512bcdd0b2b3e292cf76056b4660b2dd59f5526ea875b682579ec3f5c4f465667936d3936b61fa03aaa388ce807ae8e7075245a5fca2c27ba3b905574b8c6e30424
-
Filesize
61KB
MD5ab2f8dacd501c6e8883c076997dd28bc
SHA13f522e03a5ac17a43ca5de0733f573b78238d0a5
SHA2564c6168aa0f7fe378a91c5341e9e2e946d8521dbdf33f94cfd7fbbf83f26f34c3
SHA5120a7b92979929bfb9d3f06cb27f8456b95889e2348552103c1c05edf95f44c6e27254cf4cf5177af12e85fb8c78553c814b37223c437412b2f1af6062887d227e