Analysis
- max time kernel
150s - max time network
120s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
06/10/2024, 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe
- Size 82KB
- Sample241006-e3xnhasepm
- SHA256 f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3
- MD5 b8f7014820314583359bf334344258c5
- SHA1 96050af47bd360174e5d109f49541485d70f610f
- SHA512 7755c9a5fb0aa89674b8da873eae7952a0c1374a2a4130f095ae88871c4a73547edc1c1a9707877def78e799f5d4a13c725ba9bcbda02d7fdf96b4348e69d295
- SSDEEP 768:W7BlphA7pARFbhM0Kkq81LOyq81LObC8p8f+EA8N1J3DCl4N1J3DClIGpyPw7lb/:W7ZhA7pApM21LOA1LOPBlv6Blvexl
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3474) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\7.png.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Games\Hearts\Hearts.exe.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\localizedStrings.js.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jre7\lib\zi\America\Martinique.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Mozilla Firefox\osclientcerts.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\7-Zip\Lang\lt.txt.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\settings.js.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_Off.png.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Journal\ja-JP\MSPVWCTL.DLL.mui.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d11_plugin.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\settings.js.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Mail\it-IT\WinMail.exe.mui.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jre7\lib\zi\America\Hermosillo.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-left.png.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe"C:\Users\Admin\AppData\Local\Temp\f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp
- Size 82KB
- SHA256 46ade1bb9a492c896b023768ebbc8c3e7cf37cc07d1ecca005e473a3703cf9ca
- MD5 4b2d483592aa9c0be8b7b427b11cb863
- SHA1 0b33bd0d46d7a12fa68e0c1281582750999e39d7
- SHA512 057995d36502526ce61ab7295e7d3a08c54a87e805c161512962b1c79e6f6eb14bdef034c83f194e7dbf59bd63052ff46e153990f9cec1f39c79e552486a288d
- SSDEEP 768:W7BlphA7pARFbhM0Kkq81LOyq81LObC8p8f+EA8N1J3DCl4N1J3DClIGpyPw7lbq:W7ZhA7pApM21LOA1LOPBlv6BlvexA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 91KB
- SHA256 0f71c02a34fc42c7177f8bfe3bd8f445fb5a7a3ff6be8bb901c547cf7e81396c
- MD5 dde26a0a399f39c3808fec3c643cbf44
- SHA1 83a6e1ffbc4205cb79c83a290d81c8acbd32a50f
- SHA512 d3f45b1db69d2e26d88637a00d2990643d07b4f035e0d7da6a9aa49549b1b9f649fd65ab381bd1ace705f8a67b2602d58bc80c0d51608b2d2d6d7f249c45b318
- SSDEEP 768:W7BlphA7pARFbhM0Kkq81LOyq81LObC8p8f+EA8N1J3DCl4N1J3DClIGpyPw7lb4:W7ZhA7pApM21LOA1LOPBlv6Blvexu
- MD5 SHA1 SHA512 SSDEEP