Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:32
Behavioral task
behavioral1
Sample
a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe
Resource
win10v2004-20240802-en
General
-
Target
a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe
-
Size
61KB
-
MD5
639036273e53d4aa2d70bebdf38e0390
-
SHA1
9ab95eb83018a8de919747a6173f4b5d058fc470
-
SHA256
a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bac
-
SHA512
38c15cd7a72ad9071930d6263ed99ad053e2e53361a0b244bf21973585ce5bdd32694b1efeb5be9fe30ef10873d310f322873135a5bab99c612cf04c5f889ee6
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBApwp133EskmK+:V7Zf/FAxTWoJJZENTBAOIfmKJfmK8
Malware Config
Signatures
-
Renames multiple (3139) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1672-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a000000012033-2.dat upx behavioral1/files/0x0002000000010621-6.dat upx behavioral1/memory/1672-74-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgzm.exe.mui.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsFormsIntegration.resources.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\vlc.mo.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository_1.2.100.v20131209-2144.jar.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jre7\bin\jfr.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Internet Explorer\Timeline.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Games\Chess\en-US\Chess.exe.mui.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe"C:\Users\Admin\AppData\Local\Temp\a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5b11ef81eeae6f2db51a9891196c3c49a
SHA13b085877db93db81ef3ed16d6e55aefed4434b1c
SHA25609cd2dd87b600c4f04d548ba03baf0f0442e6e6b39fdaa22ca931b7bbfe92ea4
SHA512ed5ba582c8c9722c7d1ad2ccc60b006b521d9fce1d70146e8f88f8d786ec8bd1da0465348e8b3b7f81967eac9ecdc03557933856ff3bca2fad31cf4bf3252114
-
Filesize
70KB
MD529e45c98eb80d90e7cad6f34b91a791a
SHA1acd6d948d2f80ed86bceacbf3fb8e7aea62314a1
SHA256e721b6c45eced91e6099c01cbb853e7913cb5f071d5a19fc3fb8dba747d7e0d7
SHA51279a08ea5f6807b1745d82ba4d518fae571094f539c0da94e1ef7278612f500d28e2266ea42ee28a0ebc87a0da2649e3fad44160a0a5dac42dd49f5b9ceca8190