Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:44
Static task
static1
Behavioral task
behavioral1
Sample
7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe
Resource
win10v2004-20240802-en
General
-
Target
7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe
-
Size
91KB
-
MD5
f1dccbdba6847dadf05cdef2ed710710
-
SHA1
a2dd483e654003e1b042be60693c3ce70e7f3293
-
SHA256
7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079
-
SHA512
4d34465c20e4d08d1bb6a12a3fb99622866c5068e105d530dda1f5620fc2df6f42083665e4171717604eda45464c291513d56496e6843a9b43d6772ad8b2b019
-
SSDEEP
1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKgg0///x9zK+:69WpQE0zxg4n3
Malware Config
Signatures
-
Renames multiple (3055) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre7\lib\security\local_policy.jar.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\7-Zip\descript.ion.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\YST9.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Mozilla Firefox\Accessible.tlb.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nipigon.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe"C:\Users\Admin\AppData\Local\Temp\7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5a9d1ca0e8420b0c26ed7ecde6613c95a
SHA19680287f3fbef60ff3909ca8a30f41e49375c3ca
SHA256e8fedab7da9e071be570eb3c4776a751bea81eea8f522ec392369a586b5bf6c0
SHA5127bd7e0d9b119fb8b0d0085627be06c312e20fb97dbb3ef553de6d9a1cab08267693ee3724203e4d0412a97dbe30570216fcf6df4cb5d431e261a6d04343ad070
-
Filesize
100KB
MD500fddf7e1793cbbe1c78798b66108629
SHA1a896c9bfda3db15f3edda844c092aed1c2b2a7a0
SHA256d45f94488cd3534fa1a95fca880bd21bafb693362d77af23f527e2c747ff175e
SHA512dafb084e271b0d32fedad8e43c05637a163b0d364e368888a6b140b423771932d1b2f80ac4ccfa76e7970aa369c439cc170fef0304781bf439c30f4cff373a38