Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 09:35
Behavioral task
behavioral1
Sample
5ff6128a99c8cd09bc3d5767d0157630N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5ff6128a99c8cd09bc3d5767d0157630N.exe
Resource
win10v2004-20240802-en
General
-
Target
5ff6128a99c8cd09bc3d5767d0157630N.exe
-
Size
58KB
-
MD5
5ff6128a99c8cd09bc3d5767d0157630
-
SHA1
6aae745968989c2e9d45d923119f4513c3c0b1cd
-
SHA256
ebd2dce823b81d75cc767c3c1fbcccfccd78c595664f51b84f8cc60c55378cb8
-
SHA512
16c8112f1bbb49f8548c0a06c6d63f345293fa1f9a8b9e6662179efd35afae784e222bc7b6b3e0e57bce6c7abb480506bc5a656d845449d05fbcfe08a60acc9f
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tirZSZ2:V7Zf/FAxTWoJJ7TTQoQh
Malware Config
Signatures
-
Renames multiple (3242) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2916-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a00000001225e-2.dat upx behavioral1/files/0x0002000000010620-6.dat upx behavioral1/memory/2916-68-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Engine.resources.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\DVD Maker\SecretST.TTF.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\common.luac.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Internet Explorer\images\bing.ico.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jre7\lib\management\management.properties.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ff6128a99c8cd09bc3d5767d0157630N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD57c89b1d465a1f669b2ae1fda2301a947
SHA1893d5da2c956134fed5de9fec71d742be4023a40
SHA256a731840aeda06efe576015d7cc142f6221cc0e5b97b09e1834d801cd07b624a9
SHA5128fc3e1abb3ce29b67958c277510416562446fe721da5d7105f4d4c44f88a893d9fb909f1a0e319be103fe1d9c91af4bb13c5a8436d130d8d0b3ae94a8b4b2592
-
Filesize
67KB
MD511e9a920c2a8c6c61657a96be7af4d5d
SHA1b409cb5ed1c50a810cd7c701633703b1a40e1886
SHA2569616ab9b05fcb3416142bc5c1a4975c2332d99e9eefa89f5b6936305a60e7786
SHA512b21e883815395d0efeb1207cf9965846d6252966a5c6b5fec757fbed400d33f5d5911f8b1f18fa6b69709e0305e8c95e9ee04231d2e384944334e4fc25a61ee4