Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-09-2024 09:20
Behavioral task
behavioral1
Sample
147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe
Resource
win10v2004-20240802-en
General
-
Target
147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe
-
Size
42KB
-
MD5
b8f3dabfbe6548176c3adf739e9bce00
-
SHA1
2f9a78e0f94c6cab22ce088cf117ce9870e6bb20
-
SHA256
147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4
-
SHA512
f06cc1b8624086c60175f5e3f506a0dd8864d1c99a8904cc1b3b781ebe528c0a4c01aac3787b7601e45c3f0809f70da4edf12f9edf14824bed08669247340556
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti6YIV101EQd:CTW7JJ7TTQoQcQd
Malware Config
Signatures
-
Renames multiple (3273) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/files/0x000200000001067f-6.dat upx behavioral1/files/0x0007000000012118-2.dat upx behavioral1/memory/2980-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2980-75-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pago_Pago.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Toronto.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Samarkand.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jre7\lib\zi\CET.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jre7\lib\zi\America\La_Paz.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe"C:\Users\Admin\AppData\Local\Temp\147269f8da8a8ebb25eb5528ce1ea10dc0cddd5ec3ddca904b0082828805cea4N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD51467c93568fe47877cf99e7170ea6364
SHA145ad0e8d82fef2b42294d9b287285421d7f78132
SHA256671a2b71d758d62a6f7a11f2e20f35a3a525aff17da327d23dbbb0cd8d2efb9e
SHA5125e4f0e29fffa18e6db3de2756596e9ae9930a6d11201979a04b5def6635c81f620927a357490789c78a8aa6aa883c76ec8c4300170d3d6a25608355d63841ee2
-
Filesize
51KB
MD52e281adc7684b56a1be22ab5d8ba6481
SHA11349c0863e5b81d09d11d852656e7fe0ea986cf2
SHA256c89f4df9372914801d4f2f5f253ed3dce86e4950db5900e7d3be3da78703e3db
SHA51201a99b6109c27be8d5ea00df74fdcfff34b8040dd3368cf5ed40bc5743d417c298317eb56772f1f2a43db2496fb2b3aae067b14dad98b714b5c298ec9581529f