Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:24
Behavioral task
behavioral1
Sample
1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe
Resource
win10v2004-20240910-en
General
-
Target
1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe
-
Size
63KB
-
MD5
32f0ff4c3f34f63bf06915d99132505c
-
SHA1
0525e9d92a9b3a453999d90544ea1915df2a8d2b
-
SHA256
1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69
-
SHA512
b034f425b885c6e1d90799965f5dce1cef4ec6406f37da04625fb6f4619aa3fa07fbc2f8f103781cfc36dbb3009ed1243afa43a31ea4a37884e021cb4815c3b6
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3P1:V7Zf/FAxTWoJJZENTBHfiP1
Malware Config
Signatures
-
Renames multiple (3756) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1484-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000c00000001226a-2.dat upx behavioral1/files/0x0002000000010674-6.dat upx behavioral1/memory/1484-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jre7\bin\sunec.dll.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Mozilla Firefox\nssckbi.dll.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jre7\lib\tzmappings.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\gadget.xml.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jre7\lib\javafx.properties.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\7-Zip\Lang\lt.txt.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\icon.png.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatialaudio_plugin.dll.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\settings.css.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Windows Journal\it-IT\JNTFiltr.dll.mui.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\cpu.js.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_hail.png.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter.png.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\DVD Maker\OmdBase.dll.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Java\jre7\lib\security\local_policy.jar.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_nv12_plugin.dll.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe"C:\Users\Admin\AppData\Local\Temp\1d691141705a3d5591c099e7d4b0709bdc4b1f46f85a1fbe328858b53f967f69.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5eb6f353ca8e1f2b16c0f414598c744aa
SHA1bc124104e92a95fcfb60c13ed2e1fcd307dd2a9a
SHA25691b906602b187764735f8fc85b918606c0d2af71e82535553ca00e70e26f5500
SHA51241a0a2185f0d7af75328cf2e08ada23b84a966b4d00280046c4d7f513b999826107cbbf5aae0535fed03c132eb67934118f88733aab5858c63fb727b58837f92
-
Filesize
73KB
MD525c82b65e51b4b74a7dbdfd4f3bc557e
SHA1147dd5775c911f23b5878cb3d3bae0b5d15eb9d4
SHA256171fb1f52ea62575d0121fe623efe379577590da38577d0c497b61ea1beed509
SHA512a91c3a24071c040f13659b2b72cb5122df59859eb653df295b49d5370e865a5220aa38fa408b82431bf2422005fbbfe400b1b338e75c1547c265dc4da89ea8b1