Analysis
-
max time kernel
148s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:25
Behavioral task
behavioral1
Sample
8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe
Resource
win10v2004-20240802-en
General
-
Target
8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe
-
Size
57KB
-
MD5
32eb6838ac2a52d3e4a34392461bf12e
-
SHA1
e593585f06083e56f282e478759145b98be61c3e
-
SHA256
8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794
-
SHA512
701559e785742e5bd7befb999dde7c5b872be523a8bff26e12b29494331105cd41a66e77ae708895b6163f9dc70ebd56c3fec1ec5b0062811eb0395e4a115a41
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIB:CTWn1++PJHJXA/OsIZfzc3/Q8IZTr
Malware Config
Signatures
-
Renames multiple (1023) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1756-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x001500000000f6b0-2.dat upx behavioral1/files/0x0002000000010480-6.dat upx behavioral1/memory/1756-26-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\ConnectStep.emf.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\desktop.ini.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe"C:\Users\Admin\AppData\Local\Temp\8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD51a3ee467c0fbe0cc99553ce3c015992b
SHA15e9723973a4cc52d9efc0111bcfc6d502380ade7
SHA2568d72b47091f5bbc98e5a60a0615652c7763e20dae1f9359b5c402cb1d2e99b07
SHA51232d60f8c462f7cca4374d312168c853db88f2daf68a70030ac3b9dc5c71acbaff39f7b3db70a135c970ae4e61fd82ea3ee5026e1df046185ff60f07a908765b2
-
Filesize
66KB
MD5e4c72d8942958f622651a31c2632c267
SHA1c0800a22b0e6514ec2cda7b92e5f88224b99051c
SHA2568397e214d882cf6ddb0faf6dc63e6db52023c8e4632c5128019a0cf630c3085e
SHA512f9ef405605fad776c9bca49989c6e9cc1395354737546535fa16855a2a0efd794af504bc2d2472a518c085ed70884c4e99df797d63a8dc62935ea5a460b031bf