Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 07:05
Behavioral task
behavioral1
Sample
f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe
Resource
win10v2004-20240802-en
General
-
Target
f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe
-
Size
38KB
-
MD5
2e7af29b51d3eb7eaed6e4fe0681e2f5
-
SHA1
7905ce9fd324c40096f3b28a0d6a11accf3fbd92
-
SHA256
f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6
-
SHA512
ef0a085426fefef3e19714007c4ef52ea77d8d24debb8ab09b2358d74cf915185e9805e285c953716386c9d2deda8712e46033939473dcc34c225d4754b4644f
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tifV0p:CTW7JJ7TTQoQfWp
Malware Config
Signatures
-
Renames multiple (1086) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2388-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000900000001227c-2.dat upx behavioral1/files/0x0002000000010463-6.dat upx behavioral1/memory/2388-27-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tallinn.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\desktop.ini.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe"C:\Users\Admin\AppData\Local\Temp\f1adfeeb7a676b46a7bd1ebc0fbd7091e2f10ad0d1f5e1e9654998d082e213e6.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5c4e8be5e5771fab79836402691fd87e4
SHA1480aac28a7c31e2ce3855263a771b87ca1e23076
SHA256d469cd9c668acc4dd6ab6ae1378164a23a31fb4fd7400abe585af88d4437ff5f
SHA512f51bf1f297afef20ace4ef1676dcbb8b889b1622fda3b85c2378e94e6eb4436af4c96dc75dc4a45267c100ecb449fdce064de4ca6e150965a2f91baf9b23d95f
-
Filesize
47KB
MD546bf89548075a3158c537970566c0211
SHA11c5f8f74c2fad522eff613c10c54873584b9d2ae
SHA2562ea2c861ac0ce055cbc54bd3bfcc78771988ae791b368d46c80fe7d5abba03da
SHA512dd28d2e249af70851f1fe7e00f01e69acbeefc3d7616e0682335aaab0af795c5701baba7da2f2f47a552fd731d401f469fc3a1f8e0795a1c9f799da30658d106