Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 20:00
Behavioral task
behavioral1
Sample
ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe
Resource
win10v2004-20240802-en
General
-
Target
ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe
-
Size
36KB
-
MD5
3d1869a0c38b13e8e469225bf6098110
-
SHA1
bd6dab87cc7f33e86b19548e45ecc5a8f66e767e
-
SHA256
ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0
-
SHA512
2912b639aa84e184c49497842585195765d9376f3965ee0eec32e96cbd69d1e6e77eab2299b5ceaaef14c302c5af0c6c80e9e79d0b8362a7972dc05998068279
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/titPdP6:CTW7JJ7TTQoQtFS
Malware Config
Signatures
-
Renames multiple (3255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2272-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x0009000000012286-2.dat upx behavioral1/files/0x0002000000010620-6.dat upx behavioral1/memory/2272-71-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Brunei.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Games\Hearts\it-IT\Hearts.exe.mui.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Internet Explorer\Timeline_is.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Yakutat.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Araguaina.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Bucharest.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kabul.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe"C:\Users\Admin\AppData\Local\Temp\ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2272
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5d0249103d6cf41a210e3a56f644872b4
SHA1d839bfc346265d4afcdae3a92123fa8b1e663d93
SHA25663a91b9a273e21fa1e68b1d50036f38e142a9e8ec6dc7f92dfadca59924d2d21
SHA5128936fdcf6409cf9d5ef4738a1e5db4e5f5329a840ceac53b05e8d10e52bd146115088c4eaf1736763fe4e56b9ee7ecc03390f21a0fb92edd16e69dfbb16cde53
-
Filesize
45KB
MD5cd12fa9ed2b30333b3b1dd42d4478d0e
SHA168b3aba64bdc1ae353e303f1fe6b419380fd1364
SHA25646c9aca5641bec5395cea5cc0323d902df38e7e888b702ef787c67d38f3dc9bc
SHA512994ff738c609e08e795b7fad167001fa7ebc1733db573a3f839d23ab67c5b52c4be46347e1df7a514dcf505143c7cfb207058a00eb54cf76b15693ffcee33f7b