Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-09-2024 17:56
Behavioral task
behavioral1
Sample
221f2edb4e5ca495ac046be197df86b0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
221f2edb4e5ca495ac046be197df86b0N.exe
Resource
win10v2004-20240802-en
General
-
Target
221f2edb4e5ca495ac046be197df86b0N.exe
-
Size
75KB
-
MD5
221f2edb4e5ca495ac046be197df86b0
-
SHA1
1e836b0b4c7ca4da677c033dac2c29ce4818d8f9
-
SHA256
80ddf050eaed4b4c670da8cc1a83402fd7b72c0a3f8ff5243784027e5ad8a7f2
-
SHA512
fa2b0a2adba0e900dbbdc7c5c81c68e7767b271cab8d6ed0528ebfa71e759febb3e6d409f5d8e74c07330f267127d3738f2476e1f0d06817524e79ff27507fd0
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGl0Y:KQSohsUsUK90Y
Malware Config
Signatures
-
Renames multiple (3148) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2980-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x0007000000012118-2.dat upx behavioral1/files/0x000200000001067f-6.dat upx behavioral1/memory/2980-75-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tallinn.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\7-Zip\readme.txt.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jre7\lib\jvm.hprof.txt.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jre7\lib\zi\EST.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\VideoLAN\VLC\Documentation.url.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Internet Explorer\pdm.dll.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Catamarca.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Microsoft Games\Purble Place\es-ES\PurblePlace.exe.mui.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jre7\lib\jce.jar.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp 221f2edb4e5ca495ac046be197df86b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp 221f2edb4e5ca495ac046be197df86b0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 221f2edb4e5ca495ac046be197df86b0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD505b20f3a79fcbf99ba2010e196828fbb
SHA13b2ca6777de43354db9a26218d3536aa1fcd71e1
SHA256911a98052cf9a319dd444d2696e67f57522a23a84684b54b2814a6b9ebf44cad
SHA512605aadf3c6396dd6872c7eff6a873d22d10823751b8a7b01158bce9c050640f87fd7da61a3d6a3e340ff91f269db599a6825e6ad78906b0a71bfc0df506f29df
-
Filesize
85KB
MD548e355b0f556dba757936d3427dfc695
SHA1bd89f24606ff8a0872b1d66c6d38eba38cd15a56
SHA2564d06a214f97b31d1e41816e021827a3530569d8b634b1e79fd5f282c7a23e7cb
SHA5122db4485d2310bc50d8e05d19571594f301b6202c18f5c8e520a307ebd67a838ed3679ae4491a4b1b918b3884d8be511d46b11f4cc7615aef6d88d9715b5f1b19