Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:39
Behavioral task
behavioral1
Sample
036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe
Resource
win10v2004-20240802-en
General
-
Target
036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe
-
Size
29KB
-
MD5
464b21a55dabd603775288482ffdd1ca
-
SHA1
33fbc0a920f64339b6e718e4b4939e7bd29abe42
-
SHA256
036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72
-
SHA512
c6fa72535b06787585dfc62fc890d39644a60503ef10f1c6acb236688143b2b6a1d92bfacdb6e8ac05e75e958a880b8a2f88e85dfb3ea5722e8f5432252855b3
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9yVz4QVz4C:CTW7JJ7TgB4QB4C
Malware Config
Signatures
-
Renames multiple (3754) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1576-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000d000000015ceb-2.dat upx behavioral1/files/0x0002000000010621-6.dat upx behavioral1/memory/1576-70-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\picturePuzzle.js.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down_BIDI.png.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre7\lib\jfxrt.jar.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre7\bin\javafx-font.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\GIFIMP32.FLT.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_bridge_plugin.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\libsubsdelay_plugin.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xml.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre7\lib\zi\America\Juneau.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre7\lib\zi\America\Santarem.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\TestRestore.vsx.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\settings.html.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\settings.html.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tallinn.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Media Player\fr-FR\WMPDMCCore.dll.mui.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_pressed.png.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\ehshellLogo.png.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Games\Chess\it-IT\Chess.exe.mui.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe"C:\Users\Admin\AppData\Local\Temp\036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5f4930231fae8b52a5ef6e908cfd3850b
SHA1739a081e210217acc6644c1797bab8407bc6aea5
SHA256e6f7f94385054d3c005bfe07d965b7d6c7e58a9b89b7e1d51217918674ee24bc
SHA512fc871a227fb3f655ee002bb743c79b5de61d95765360984ebbe00b9caa2b7df0ad5c34f76df85953c308872c5ce06d55976f18f9008bccb52d9df2fa7a321c81
-
Filesize
38KB
MD55baa090feb2044e9ec1b1df47f25a67d
SHA1a81510fab9d5255502e0d9f645dbf3a72fa60a2c
SHA256cc927796c73de7583cae4ea5a7094a08af7c1dc2cb760783431d785ffbc451bd
SHA512cbc711d7fad57a251f136926c4c9e5d3d962e94ae6d7bf469da47c8c645e9f6f7dd05b62b2ea4760458f2ce2d7f1440ca949e18d56037a788617b34632b6ec03