Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe
Resource
win10v2004-20240802-en
General
-
Target
0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe
-
Size
52KB
-
MD5
8cb805d1b9304a13e960362411e40dc0
-
SHA1
0177c1c3e3a0dfc62578757670621044ff30f972
-
SHA256
0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb
-
SHA512
be654332f654bc8ca8ca62af7a31d2d06ecd4f62890d6af5f2f604c6b585553d2cc8ffd5e7e58ee77874b6757b69c6050f2f975ce7e477d1db72200b93819303
-
SSDEEP
384:GBt7Br5xjL9AgA71FbhvuNBNQFrs0AqAJwO1AqAJwOfF2JouP2JouQw5A5+w1t4:W7BlpppARFbhHFoqAJwBqAJwRJofJoT4
Malware Config
Signatures
-
Renames multiple (3735) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\InkDiv.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\icon.png.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Media Player\WMPMediaSharing.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Internet Explorer\pdm.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\chkrzm.exe.mui.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libscreen_plugin.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Mail\en-US\WinMail.exe.mui.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jre7\bin\dcpr.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jre7\bin\ktab.exe.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libhds_plugin.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\gadget.xml.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\gadget.xml.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Media Player\es-ES\WMPSideShowGadget.exe.mui.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer.png.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jre7\bin\unpack.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Defender\MpOAV.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Defender\MSASCui.exe.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jre7\lib\zi\America\Jamaica.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar.tmp 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe"C:\Users\Admin\AppData\Local\Temp\0b1fb2067dbc1fdecd924051dcbe8413eaaa509e7ce777f7927b4303de3e23cb.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5358612e13ce73b7e0c441118c1982134
SHA18660e7890068248e764ceb229acac218870d23e7
SHA25692f85d67fa06152528344b0683865cb3e7c85f6c0b6ec4bbe0dc5bcc2bbf9a35
SHA512505599d634a993d199b3de2a2d8b56004e19f00ce9694e44799153659c99fe860906671ab029ce561bf170586a520e4c2287b0f5df1ec01177fd24ceef9aa6b5
-
Filesize
61KB
MD52e382e87141dee2f4fdb82f54f95fc62
SHA1a1b6c013d9f222c1ed92d49801fde6911b02b9c9
SHA25695faa35b9e0ac3b660ea333673b027a0182c95d9a7775f19404db34f254730be
SHA512d50bc32e5fdf08e94680e19653781a1af920cf40eaa94bedb2f3456a6582d9fcc9b910bb9c27976823a281ad732e36148eaf5c2fc745cf4dbf0380769fb8677b