Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe
Resource
win10v2004-20240802-en
General
-
Target
2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe
-
Size
45KB
-
MD5
66360ddcb10cb515ea6659cb23d524f2
-
SHA1
c3af28bbfe728ed256a13ae5f6cd72f47adff57b
-
SHA256
2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51
-
SHA512
7e0355084a490f0735ca05051c9a520e8e98ed356bae556a01b9421636c8cdd4e23c2457feb378f2dac2a7a6be401a7f93994ec1a54c6da721a8872fbda842dd
-
SSDEEP
384:yBs7Br5xjL8AgA71Fbhv/FzzwzgTAUAcfqg7Z:/7BlpQpARFbhNIg3
Malware Config
Signatures
-
Renames multiple (3824) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\flyout.css.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jre7\lib\security\javaws.policy.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\GIFIMP32.FLT.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jre7\bin\awt.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSSOAP30.DLL.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\localizedStrings.js.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jre7\bin\ktab.exe.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\drag.png.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\timeZones.js.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\init.js.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\flyout.css.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe"C:\Users\Admin\AppData\Local\Temp\2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD598f8cd87c5401be067136525325bf5b4
SHA1f9041eb3cf3ee9433e5da5ec6c27047f569a19b5
SHA256f0a86b656539ef4c37f8625cd1a328d991f06541cb3972c8a43a244d8009d726
SHA512903d9a11f9dbff5c187fe20d51ec697c390ec0ccffbf554330dcb123b55999b05a07b346aa66479d1ad4efe4192db44d01878e60ce71d409f69b1817f6189b02
-
Filesize
55KB
MD52218429b188f9c87b287a21bb268750e
SHA1a3d2220889bcb1bff3272704d7cabed79fbd2cbd
SHA256d6e6f584ff152208a6b39237ee2ed312f9577ff29b8c89bfae714794808d12eb
SHA51253dc82dcb672f8b337b51e947691d1b0411a0f5793d73fecfdd7ef63831e99a0f717d6abf5d0fd18121b63bdf008a897f5555c974c58f469cbbd584eb216f264