Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe
Resource
win10v2004-20240910-en
General
-
Target
c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe
-
Size
42KB
-
MD5
d8315bf38f859f5b36ccc8a0765e67b0
-
SHA1
3747e5fbb5af9e9c135af3690adf6a98ff42f403
-
SHA256
c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347
-
SHA512
70b5754b5738e81d0bc3b3b7a4e4d3023a4bd729c5b319510b0a3d792b622b4414762263bb2c9e11780c18349b62eb42b09955655a97219e619e05468b2cfca8
-
SSDEEP
384:GBt7Br5xjL9A7AgA71Fbhvnqj7jU7ubTAgpbuvx10AaIdKB7ubTAgpbuvx10AaIr:W7BlphA7pARFbhL801VvM801Vvv7I+J
Malware Config
Signatures
-
Renames multiple (1151) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novokuznetsk.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Internet Explorer\perf_nt.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\7-Zip\readme.txt.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe"C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5a2460408ef4709349cda86a220b68e78
SHA1b443c7126dfdafd6a6703db3b91aa05e287d3ecf
SHA25659d2ced1fa20b50e1ec7dde341946b82f9997a42663b4c58221b0193c7691711
SHA51213bd778c3242ff3f0aec4db46b52772e5d670417f0fad0a061e3b87e3671da1cca8a43307e0c7a7dbf5c4e3b5dcfd04b3c7307503f8f8e00fae00694362de92c
-
Filesize
52KB
MD566f1a21501a459c50bca57fb4ce48a14
SHA1087e4901f64e9ed6438a82841d89135a3c3663d9
SHA25658b4d7329f41e84f93958d2ac466c7e96df6d9af3aa63e4c89e58042a121c859
SHA512c34ce16f7c6affb67425c92c2f70131601f3cf84aff061ee7c8725c87e7568ae20f47d0f2a12d65d8aac83b5a18251f437b7bd97a331b60bc13af312ff6bf6a4