Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 12:36
Static task
static1
Behavioral task
behavioral1
Sample
aa8859e521f0be5dd5eccf5570a4a240N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
aa8859e521f0be5dd5eccf5570a4a240N.exe
Resource
win10v2004-20240802-en
General
-
Target
aa8859e521f0be5dd5eccf5570a4a240N.exe
-
Size
47KB
-
MD5
aa8859e521f0be5dd5eccf5570a4a240
-
SHA1
cd57f67e2637f45f148bf743f1ac917d217915c0
-
SHA256
708b03aa99f83e986bdcff7760e3b94c0d27db88174ce94461923de38cc39f90
-
SHA512
3d7ec6620fcb82c0efc4b8442ca8f1fda7e00b741df16f5cc81025a2ae4e6cba024727feeb6b793600672bf0af947113df24e0a18fc8dddd48dddcd5e0f0b5bd
-
SSDEEP
768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSwVEVXj:W7ZhA7pApM21LOA1LOl6vSVj
Malware Config
Signatures
-
Renames multiple (3358) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jre7\bin\instrument.dll.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\DVD Maker\DVDMaker.exe.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Mozilla Firefox\postSigningData.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jre7\bin\ktab.exe.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\management.dll.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jre7\lib\calendars.properties.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Microsoft Games\Hearts\it-IT\Hearts.exe.mui.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jre7\lib\zi\MST.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp aa8859e521f0be5dd5eccf5570a4a240N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aa8859e521f0be5dd5eccf5570a4a240N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD57e871d6e9e4b6498b0db429afe993574
SHA144aa6142b52cc08f63bf679073b147fa78a1ea2b
SHA256430a7861e22ff4dde8e5a7087145db3c20d3d7bec33d26a20043f374455766ff
SHA5125746eb113d83a472d2dd94a52d73eee88ee7afdc83c4205d899b117fc8fd25a52b903706e8d81beb1c46bbbbd08271eeb44bc4aec66a7eca61dee1914b781572
-
Filesize
57KB
MD5885e8b983674f0069482c7c2abec657d
SHA160d0f20ced736178ee8af8b6c552fab94ed79e05
SHA25664a174d46ca78433724aba5fd902f3c2d143497395a682b062fb58b034e4734f
SHA5127d6c7a6174121bb630f55250d97551aa1f4682455e461764cfa9e06e99b80d3c423c7a9a3acb33c17ab3419de010384bdad9f16e306656209383c61797f95a4e