Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 09:37
Behavioral task
behavioral1
Sample
d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe
Resource
win10v2004-20240802-en
General
-
Target
d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe
-
Size
48KB
-
MD5
4e42d19da085cf84d6b2a8f31f9e3a00
-
SHA1
290ff700ad10e8afd7f600d066faf6caee02333b
-
SHA256
d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fc
-
SHA512
d3f411e4009618fa7cfb5e0bbd0fb10934ba1d7da382930312124bc300fc2ec822b43b30c686a67cd0376deacda140f804f0607fb37ab2280f44b7246767b2d2
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJXGitPsqAJUqAJ9QN:V7Zf/FAxTWoJJXtPhQN
Malware Config
Signatures
-
Renames multiple (3434) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2648-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000b00000001227d-2.dat upx behavioral1/files/0x0002000000010541-6.dat upx behavioral1/memory/2648-74-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_copy_plugin.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsdt.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Chagos.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libps_plugin.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Windows Journal\fr-FR\jnwdui.dll.mui.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\DVD Maker\Shared\Parity.fx.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jre7\lib\accessibility.properties.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jre7\lib\meta-index.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kuching.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmod_plugin.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe"C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5e45ced5e0e14d234d975f6a19c5c2632
SHA10281b5e5ff479a33d6ddcf88d377dbbe081a9cb3
SHA256d884323ffffdd38a056fa9366e3fd0ebc3a0eb6079a67620696eb6e10726c978
SHA5120f415f8f9360795450cf6fc16e14d2e377eb39f7c63dc84f92f2271e40db948be908842dbe620cde9d6488fd3ecc97db2a0ff6e628a4b5020933cb845c292b74
-
Filesize
57KB
MD50f464c4906523d58641b61fb2fb41550
SHA11c2731fd799b210ffc60d7cd07a64d18a13f7eb1
SHA256afac0ed57f675dd1d2d683cef7a43dcabf51ee0acea1fc9e01266d6c5df3b52f
SHA51273985d5d61c11adcf0211189e6c31c060dd60623db56616d0a8953a7b6994fa07dc3eda56fdcc36ecb14f278cefe717209433b7fb5c1718dd6ed73fd78982dbe