Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:46
Behavioral task
behavioral1
Sample
d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe
Resource
win10v2004-20240802-en
General
-
Target
d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe
-
Size
43KB
-
MD5
ad6e2c4e06f0fc848ff897fd83eda0d0
-
SHA1
97ea0eff0bed46ba8704971c1364f1d41efb17e0
-
SHA256
d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5c
-
SHA512
0c47c4213e8df5819f3f33408fd6566a921d808d8f10f618a054e3851c7629553e4b281375a51cacfa859ba19a90dea66b3057c03ae2c9a2d7f0aeb71db2fa59
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiJFEF9rKW:CTW7JJ7TTQoQPyv
Malware Config
Signatures
-
Renames multiple (3250) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2328-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000a0000000122ea-2.dat upx behavioral1/files/0x000200000001067f-6.dat upx behavioral1/memory/2328-75-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Belize.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Mozilla Firefox\uninstall\uninstall.log.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libsftp_plugin.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Mozilla Firefox\nss3.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationTypes.resources.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jre7\bin\net.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jre7\bin\deploy.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe"C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2328
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD53feda6133549d488f2b527b435387154
SHA1cd60d776fa4a52f6d850d5078742f698d29f78a2
SHA2569f34723234e68a270a96868447c67e3744f1e95cbd7611c30bbb91f768388512
SHA512a0eb6bc7e720b35f078984fdc2dbd0e5e08c324548b24771438ec63b054916362040f8216326d411c57f7ac133bab38501db18cf1119583be3570243d0615e84
-
Filesize
52KB
MD50ce4546b679707f87ad98dfc217afa74
SHA1bc03c2bd9a8a7b9a9c8de8a4246f792e049c2213
SHA2564eeeeb3e2a638a2cb6b77df58c9e8b7891ef8b517f7d8f6b4a9eac884f78657c
SHA5129ba7f32611b379999b3f6f9797461d12bd12964445b63afcee67a2a1ae7c4d0ef7d5381366b393e104708dc2609729ad17d47d18d980893b85dd41b7286572b0