Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:48
Behavioral task
behavioral1
Sample
408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe
Resource
win10v2004-20240802-en
General
-
Target
408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe
-
Size
40KB
-
MD5
888c30056a580894075333fbdc4f1f10
-
SHA1
f2aa50e0d7219fd7a57a4155231eb9eadb086807
-
SHA256
408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0
-
SHA512
f5548837d27d5208f93c06a5ef421c55f4c6444bce82be6628be9db143a96cebd61f85d0cf758bd33e17aef696f17af1f038d0306fcfdda5ff2b95d3968c2f2e
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Hx3R9pi1xOR9pi1xy:CTW7JJ7Th9ko9k2
Malware Config
Signatures
-
Renames multiple (3197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2692-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000a000000012283-2.dat upx behavioral1/files/0x00020000000104da-6.dat upx behavioral1/memory/2692-75-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jre7\bin\jfxmedia.dll.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jre7\lib\management\jmxremote.access.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\StartUse.vdw.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\DVD Maker\sonicsptransform.ax.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Lima.tmp 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe"C:\Users\Admin\AppData\Local\Temp\408d72d193996c83e543b7243c0579d562a1e42ebfbfeb683c2348265d9b7de0N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD553be96e722025e583fb0d97b594c7838
SHA18da59f640b005d9490540a5b589a2e1c7d55b801
SHA25648b8c84eebae9e51bbfd0b09b9716022923e4e9b7d9d4e4b5154b0beda9d3aa5
SHA51230b3ba732018ae24326624910147ba30c41d7398b011b6f3be6fe1c86de7a7adfc9e69e820286a1e239ebf6631a72b0bcc9011dbaad11ecf975ccdb3000512a1
-
Filesize
49KB
MD5d36309071fc8b804b554a8a168d782c0
SHA1ea2afd3b71ee5f01a5c5c0e65e9a8d1474b87fde
SHA2569e054d9264ee893c26b64032b3a561e59fc68625d9d9755a509487e5821d5d4e
SHA51251ceadab454da597450eb89f09cbab43c1f3bc10b7009c73a6984d02d5ae04a0bb12230d5d63618458b8b3238485d97b8061ca12084770babb217f4c78018074