Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 09:27
Static task
static1
Behavioral task
behavioral1
Sample
670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe
Resource
win10v2004-20240802-en
General
-
Target
670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe
-
Size
85KB
-
MD5
4bfa11b5f54f219e1db74c7fa05e40c0
-
SHA1
f6bef3e8c1450fa26cb4998872576d979d0da3a7
-
SHA256
670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27
-
SHA512
e73c56ce7cf9016869fcf1968d0c879585d6fc67af71b0a80518852ee58f0b36244e1f7099e4a5767ef6f7b8d6b6fa6464379c6b0f8f85fbc117190a76d22243
-
SSDEEP
1536:W7Z+pApfGQ3y3RWvfmRfm9sKsSd5j7R6enIQhiwnKs6nKsJCfQ4:6+WpDfmRfmhz7RjnI52UhCT
Malware Config
Signatures
-
Renames multiple (3096) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\JoinResume.wvx.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\DVD Maker\rtstreamsink.ax.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\.lastModified.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre7\lib\zi\MST.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Mozilla Firefox\dependentlibs.list.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\System\msadc\handler.reg.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre7\README.txt.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre7\lib\jvm.hprof.txt.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Taipei.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe"C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5603c02af43d211f6065e56e919d23e14
SHA10bac1f056367fc7a2bf6b0c760fdd68697fd333c
SHA256f6320aa2b529c4a6857be3fdb4b9f6283cc9bbf591fa77446708b34287b18633
SHA51263eeb3c3f3c5fc9626ea330e356e15eb851e7c278afdbf4c37e3a8858c7387aadeedfbc20e667ff7dfb9d2723185039ca9e65a6d771bbdee2fd04445afe3f385
-
Filesize
94KB
MD5754cd1896488b6cf1a41ee953f6fca17
SHA1cc1f17df686f55ebc78f25aea2bb444c911a1282
SHA256637b1fa0944a86eb000dd45a24ca74ec1237a66125b818ca38d47bdcb067883b
SHA51219feb5baf108d1bc09ac6d242b13a0b791350656ab52db45faf06182f99047e4f0e1cc4d48bfdbe7eff9b38602305b1d3744ffdbbbaaf5b5ce2e4d7ca12c0518