Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:27
Static task
static1
Behavioral task
behavioral1
Sample
7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe
Resource
win10v2004-20240802-en
General
-
Target
7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe
-
Size
85KB
-
MD5
c7f6220eebb7a1715124967c6bdf05d0
-
SHA1
6681d041350473592e95f0f9f1410d5b3b492044
-
SHA256
7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109
-
SHA512
29e46f7e4b75c776a1f4d20a9be28a79f0d831e122bdb85143f2d5bbed720d6b853f305bb490444baff7864616845c7b5e088ca126e5085c083441c0de3bd4fe
-
SSDEEP
1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKgg3wI:69WpQE0zxg3wI
Malware Config
Signatures
-
Renames multiple (2910) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Microsoft Games\Chess\desktop.ini.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\DVD Maker\Shared\Parity.fx.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\RedoNew.clr.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\bin\t2k.dll.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cayman.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe"C:\Users\Admin\AppData\Local\Temp\7886f4c3f9060d48694a4419b8ac35e4f12435812692dee25bf89279258e2109N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD524aca55037c96cf6adc8eac0e0950a67
SHA1fa3feb84a7292beeabe9189bdcdbd0efd3d3ddb7
SHA2568ea45453cac115f11f5c128f5ceca3cf1fb15e3747d7db7f7c6e2481bed44e23
SHA5120c998dcfc7cd7049ee5dd4a3a2060ddca2fdd43bfb46bf9d295fd65fa4f8498046c401936d0a56da5a38379581aa0622b421c1b4357beed4283182f90cb668cb
-
Filesize
94KB
MD514ce208c9e6ac82e3927568ead34f7b4
SHA196ad5a40752478123a1378600c6953d403f9a911
SHA2568c0ea7d1e3ef7adc6136d97d1a1d1452bcc0ff77d4f5e7490529db3f402acf06
SHA512c4b386a44207c51d600cd5347c2763345d598a140fe3fa537fdf3d0b0e1bfd31f4bb88fb79f59114fc0afa0ddf96f5a133be56b283afb9050388649ed31d8c97