Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:38
Behavioral task
behavioral1
Sample
27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe
Resource
win10v2004-20240802-en
General
-
Target
27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe
-
Size
90KB
-
MD5
4967679a3813496c0dc3752f310dcde9
-
SHA1
23f41a02864f3e4227b175bcc5de00be48cfd744
-
SHA256
27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0
-
SHA512
1f24a0027aefa6309a6162789ac0130063d3ed3398e381cce33f7030604c886d1427b0c1126e3adb592293e16cc8bc4ade95697f193de4396d1f4ee061fc7276
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5Kw1qS:fnyiQSox5Kw1
Malware Config
Signatures
-
Renames multiple (3527) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2912-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000700000001211a-2.dat upx behavioral1/files/0x0002000000010541-6.dat upx behavioral1/memory/2912-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\bin\sunec.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\drag.png.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Taipei.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DVA.api.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\clock.js.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\default_thumb.jpg.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\settings.html.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\JSByteCodeWin.bin.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.bmp.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Journal\Templates\To_Do_List.jtp.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\library.js.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe"C:\Users\Admin\AppData\Local\Temp\27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD56fee170fc1a8d9e0aaa9c6a8ad7bd87c
SHA1dddbcfe3f55c29c06d41d74341027291ef137891
SHA2564bd41ed663ab557d01137dc97d8dbf40035116996ab8e606c4f55b1cceed92c3
SHA512e167a8589a1d7bd70a15a7f8752fc971141773c16e121648528e4051cb0242d69d5dda5315105e8c86a2f3569278ca0e4d605fcf0608182e6a54dc685448d922
-
Filesize
100KB
MD58a16f495e5d64a60136c1e4faff51ea9
SHA148e97c8fa2fdabd43e33e613a1539b2efc8bf69c
SHA25658f02fa4d20809617dff93c99a1a6477754a061ea9f6722c96712421637e9561
SHA51215522a591f43edd5e8e1acc3a60bd14e65a293392801bd4a324f48bb71ee689e45cb8b8d11ce203cba024a4c86d2092b32ba282367835c842603dbce60bd946b