Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe
Resource
win10v2004-20240802-en
General
-
Target
0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe
-
Size
45KB
-
MD5
b1c3a5e077547f6d533888d59f487e10
-
SHA1
c6501eb4454933b1172d742a2d19e05765f6d21e
-
SHA256
0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2e
-
SHA512
d1a6bf331bd9855694f6212d7c9e9b12595296d5823a8d0493422a91f5bb8b7833d79a3ab2b89d0864ceb5f7b1c901b1e8c1a0f19bf8dae79cc1c50dea8f0f32
-
SSDEEP
768:W7Blp+pARFbhBgnKLMWK9WKD2N2LSarSaC:W7Z+pAp2nKLRKIKqoLSarSaC
Malware Config
Signatures
-
Renames multiple (3165) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Linq.Resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Utilities.v3.5.resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\appletrailers.luac.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Edmonton.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Guatemala.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\view.html.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe"C:\Users\Admin\AppData\Local\Temp\0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD55516211141c02b856fcec9c248e6982f
SHA13ccd3854cfe03f6d138f5f5535a518ea8bd428df
SHA2566775d3f08adb8fd2c4d5b0f96eb6ddc911b8f17c4ff4e469f92a278ba3055dcc
SHA5128c20ad8022d6575c792f5542ef7c5d96f126fd4a9e869f627bfc6602f27ffa9fd1d668ccc374e42ecf60081d160692f0484809164ce3133f7ab0f523fcbecf02
-
Filesize
54KB
MD546c4d801e7fb35f83407c5a2ac147134
SHA12a8f053490406638e038a17c3b716dd509878fb8
SHA256b6add711f4c64ad32915272c945b629f025ca7bfb7f33d1427df15e93cd612dd
SHA51265ab151ef9a6c5c174be864fd4540c1ac2c090d8f279b162f43c5a875c2048733595d8718e00b598cf154b03515d39307af8c4c72c549667c072db4c29819e21