Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe
Resource
win10v2004-20240802-en
General
-
Target
95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe
-
Size
51KB
-
MD5
6e36613501bb2227eb33efd8f549d7f0
-
SHA1
1d27dd51cc9907047608e80653047283913bd7cf
-
SHA256
95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374
-
SHA512
90352b050a44d2db68adb4bba5fcc00294d58ee5b7d3ee716c6b9ed85ac840c12fabe9462fd3f510136a106a72cb940a0d80c26534d27f490ce00a7f934115ab
-
SSDEEP
768:W7BlphA7dASbSjJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c5Hjn:W7ZhA7dABJJZENTBWv361
Malware Config
Signatures
-
Renames multiple (3271) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\plugins\demux\libps_plugin.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\lib\accessibility.properties.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\bin\JdbcOdbc.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\lib\flavormap.properties.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-progress.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\ResetSearch.pot.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Common Files\System\DirectDB.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\bin\zip.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe"C:\Users\Admin\AppData\Local\Temp\95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5d285d32e19164b7787f675907a879c47
SHA19ab725ecd0768eea6633d2461955b2682b4d6798
SHA256596ef98a02f78667c76b4ad48720e1f39671eb4c72745dd5682e59de4f3aac50
SHA512fe98adcd4c27eb11f4c0e7503eb2332277cb84eb4638d2c5a490449fc69afccbab99aa5a6cf44d6c9eeb361235d2a5f0575a697b55c5632d57ed13e857f6b8a3
-
Filesize
61KB
MD5fce81bd42fcd8e35411072f12ce3586e
SHA13f6ab701648703f511d9eec36b34a1a48f4cffb9
SHA256ef2c9605657cad28287c8b71e2f18947470381c2c524fd26ee3d92c958ff29d9
SHA512d1ecdd128c73bb366de85a4e596667df28c5419d1ca51146ebe5be2d8c1e8d4084786eed935b846aa3191ece8f5087fa5762259191bef0cecd9809648ddfb31a