Analysis
- max time kernel
149s - max time network
127s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
05/10/2024, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe
- Size 40KB
- Sample241005-xt41bsvbrc
- SHA256 d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501
- MD5 54868f68262c3e0f720a6061b52cb330
- SHA1 8b374fed7bdcd10094de89b81d6101900bb53366
- SHA512 ce50f17aa49253a014ad1ba1ea3492de3ae87b4dbb4ff1772c0341ffedc143a0e3d43ad71aadbd2e7e37c84e575683d7e8721892e220c28e0e3629c1ea7627e6
- SSDEEP 384:GBt7Br5xjLdbAAgA71FbhvU8g0U0fLMzyKbNzzyKbNWkq3DLXakq3DLXavqC:W7Blp+pARFbhBgnKLMWK9WKD2N2W
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3786) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jre7\lib\management\jmxremote.access.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_right.png.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.GIF.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\flyout_background.png.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\VideoLAN\VLC\skins\skin.dtd.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\gadget.xml.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\xlsrvintl.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\index.html.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\gadget.xml.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_over.png.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\DVD Maker\OmdProject.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe"C:\Users\Admin\AppData\Local\Temp\d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp
- Size 41KB
- SHA256 712b046d090da98507635bf6526ca59127f1e6b5cf6f30a541dd923317b9f5c5
- MD5 7bfd660e1bfc8424d77b10486837e775
- SHA1 6a6403e65dcfc5d2c48b5dfbefd88ef9a235f2e2
- SHA512 ba0b76391b651b66ca7b7f38802353d1767dc76fb3e5e0edb254349339166e88928ccc04c5e185a48a9d0648dba0c2d21d4224e17d96a634c4a2a7cedf598063
- SSDEEP 384:GBt7Br5xjLdbAAgA71FbhvU8g0U0fLMzyKbNzzyKbNWkq3DLXakq3DLXavq3:W7Blp+pARFbhBgnKLMWK9WKD2N2j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 50KB
- SHA256 e303b663a7538b4105b37bf615ccc2bcdb5c2ff9e5b24eb41c3ca3025fa062a0
- MD5 7afe2bbac54ec54e95a4f1f3641a20f1
- SHA1 a4ad73485f2d9ec6995ed73c3e5d79102ced8283
- SHA512 2e1033c267941157b51bedc5e1ef14b24e792317c477469915f7b00aba197944aaa18a50902ea16e6315ca25ab334cb9a1149367d1ab50a5e893ae0d56593f2f
- SSDEEP 768:W7Blp+pARFbhBgnKLMWK9WKD2N2mN1J3DCl4N1J3DClz:W7Z+pAp2nKLRKIKqo9
- MD5 SHA1 SHA512 SSDEEP