Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 02:42
Behavioral task
behavioral1
Sample
d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe
Resource
win10v2004-20240802-en
General
-
Target
d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe
-
Size
41KB
-
MD5
c0e9e17736307e7179a3cac2fa3050cf
-
SHA1
171f735f038e39685f47d652e382fc19fd6a3341
-
SHA256
d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940
-
SHA512
fe725d5212b9c2a5cbfe6cc19e61d38e7e7b9bac5ebdf15689083dc454b11b31e35fad03496c90fcf9a28d6feb0e4c017d7994ecda6f5329a295c19c21a8390d
-
SSDEEP
768:kBT37CPKKdJJTUNO/sAmgvsBqSW+QxbDMCAW6R0gsAmgvsBqSW+QxbDMCAW6R08p:CTW7JJTUNO0AmgvsBqSW+QxbDMCAW6Rw
Malware Config
Signatures
-
Renames multiple (3727) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2080-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000b0000000120f6-2.dat upx behavioral1/files/0x000c000000010546-6.dat upx behavioral1/memory/2080-70-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jre7\lib\zi\America\Adak.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Internet Explorer\iedvtool.dll.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\local_policy.jar.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jre7\lib\zi\America\Maceio.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\shvlzm.exe.mui.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Media Player\en-US\WMPDMC.exe.mui.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\picturePuzzle.js.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\2.png.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\library.js.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\settings.css.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jre7\lib\jvm.hprof.txt.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Microsoft Games\Chess\desktop.ini.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Mail\es-ES\msoeres.dll.mui.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\VideoLAN\VLC\axvlc.dll.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\settings.js.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FLT.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe"C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD50e85c7e5fdd564b818d86ec8b2b2cb54
SHA1fbde6cf19b1e77ee4c7a3cc6f49778b8e8f1db4b
SHA25604c596b813ebbcbd6284f0f34583302287e583d9615a8f94376cdc95a8d2175a
SHA512ca7e3ef04be724611ac257872947e37f624ca62b7b096ca12a7a070f18c1f2e7df181427544a7daeb0757bb16cbe67ac38957d9967c94570db17de734da9c795
-
Filesize
51KB
MD53adfefac3c3e06207cc9e0365c6497d0
SHA1d6102e7948d47407337677321146abdaf83b7ba1
SHA25620a381dc0898f237481f59c7147402ea4946bb519ca046a24f8510b159c6674e
SHA512b4fe2412881e7a2279062876491ec86799330547496b70a457a21389a6684428e34f16ec31180618ef341b0e37b6e53145f35118137937c1e95b75227f1fb59a