Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
081c75d37cfea4c1b773397243e69710N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
081c75d37cfea4c1b773397243e69710N.exe
Resource
win10v2004-20240802-en
General
-
Target
081c75d37cfea4c1b773397243e69710N.exe
-
Size
89KB
-
MD5
081c75d37cfea4c1b773397243e69710
-
SHA1
a4192e99d1c5fc1364341b6745f1a57e4356a4fe
-
SHA256
bf08df942add5f53899c05180ab83892b7654e2be6114efc6981600ef7469321
-
SHA512
368defe960ce3b26c5f530f7a4d516783364890eb66ac31dec6b4f738c3269d27fd8346df2c055eb2f694b86a70cc6f2e9a44fa6018cb0b0985ef9cd84429203
-
SSDEEP
768:/7BlpQpARFbhiWb8naOnaBmT3TTS0Lai1xWS0Lai1xq:/7ZQpAp/EaiakT3TTdqd2
Malware Config
Signatures
-
Renames multiple (3209) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Guayaquil.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh87.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Mozilla Firefox\postSigningData.tmp 081c75d37cfea4c1b773397243e69710N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp 081c75d37cfea4c1b773397243e69710N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 081c75d37cfea4c1b773397243e69710N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5ac52fd2067c6d0cd92c9d5c6835c9d2d
SHA1280e6dbe72ac4c18d6cc33149154b7e18cfc1dbb
SHA256984fc243e022424dc708c00ac8a9057136d2ffc31fbaf7ac2bbde267b1bf0c81
SHA512b6fc05f8f0df8de393f2d6059583cb44fa67f1cdf8ce3c476208027918e4eb5cc39a06d3903264b74231591809d8955f4cc66841a739497f1e7bcfacf974227d
-
Filesize
98KB
MD5e8b2f7e72a6479e45d8e9831361b0169
SHA1442b97a4fe8ac3014f8182fc423d035191255de8
SHA25690a9ae9b4638705b5dcf37b77b240382d6c250af6062578f0ce8be641c8d6a61
SHA512094a5a29c52d87161100079bea48f4651da9e340e2e4f7b59e916392d78d7c4ac297a39c501cd41756d76bcc3ad20b0ebad449f42f5a521df8a2dde28852c712