Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:40
Behavioral task
behavioral1
Sample
9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe
Resource
win10v2004-20240802-en
General
-
Target
9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe
-
Size
138KB
-
MD5
4293ffd84cc7c2792fee40c42fb5dad0
-
SHA1
2ef1abe3c10d59082ccd5eb278b63462855be098
-
SHA256
9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5e
-
SHA512
93d2e03abd6f0ce7cff910bd6a2af6951bf80b5e123f7a46275c1da490cfd1f28bddb1850d16eb17ae8c5706cb209f08ae7c86f024f0dc63f21a7186097ee286
-
SSDEEP
1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8IZuEd4HZKMSs9w7WsLhEC7ptU8eUel:enaypQSo7Z54HZKMx4dhECVneUel
Malware Config
Signatures
-
Renames multiple (2844) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2308-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00080000000120fe-2.dat upx behavioral1/files/0x0002000000010485-6.dat upx behavioral1/memory/2308-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Microsoft Games\Chess\desktop.ini.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Vancouver.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\7-Zip\7z.dll.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\bin\klist.exe.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Bahia.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Monterrey.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Chicago.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\bin\servertool.exe.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe"C:\Users\Admin\AppData\Local\Temp\9c869a677bf00dad3f33a9cb63409c71a02eceb5c928886b9e9bd50e11a27e5eN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
138KB
MD51d8d4d1fff7e9f4cdb6ea81940d56c91
SHA1ee0b164ed710e35f233ed943e48504a74e8ebdfc
SHA25671316d8068cb59c8a1c207a292aec98bb7292a70b4b25f4b6d93182014d626ad
SHA51232eed8f5dd359e6d8a9cb3e06f907c482f8d145ba1cad2a2009b7785af96d36836e5a5f09919024dcb8bf4f6f8278007b0176d175554fb0eadf09054da7f7ccf
-
Filesize
147KB
MD5e42d6d186a7efe425383efb2140771c6
SHA1871cf951e37db5d0173a888feae78abea099b9fc
SHA25638f7e0879d7a642b4ed753ff3781d203d8a87ed23d20ed3dd7c77224739ec14d
SHA512cd9b4b526ae7f22c0415f005e5fea440fb52e5aa188834fb3acfaf2887930d555feed400030e38294f110dae0cf7f238e4a624e081f7cf71de13581d09a14605