Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 10:37
Static task
static1
Behavioral task
behavioral1
Sample
78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe
Resource
win10v2004-20240802-en
General
-
Target
78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe
-
Size
67KB
-
MD5
44f9ed041c33e05c73095dfabc257fd0
-
SHA1
f1e4b1017534ea1b59d4f6d21552167b15aa6823
-
SHA256
78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcb
-
SHA512
0b90ce446e5db98e266accb6943366d135a4f84c814a8612448ddc6c580c6b1170bf2b3d02508e46dc3e1aaf280f03ab8b8f2ca5387bc337dae20173860e2946
-
SSDEEP
1536:W7ZhA7pApw03vR03vcltdtSsU8Tu8Tmwzw3wZ:6e7WpwYRYUtdtSsBc3wZ
Malware Config
Signatures
-
Renames multiple (3179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Internet Explorer\images\bing.ico.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Printing.resources.dll.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Common Files\System\wab32res.dll.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\DVD Maker\rtstreamsource.ax.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\7-Zip\Lang\ms.txt.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe"C:\Users\Admin\AppData\Local\Temp\78c31f4136a0a20770e037d0a3dbb2a57de71209da58b9d6b2ca4488b0a49dcbN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD50f6a918cbd6d82b4bc14236b1b3b4a3c
SHA1a54f1584749ed83fa77eb419609a0b419c28fdc7
SHA256a5924cd2743568b517d173faaf84f8c1e11390bab49d5eae80f62bc01588dfad
SHA5127896d5cab25a677d63e75529701faa74fddb8ed6c67524c475bfd2b0d3cdab4582ac5b7454bd977c23eb55cb045db573ae4710ea411d5feb430fccfaeafea5c3
-
Filesize
76KB
MD5b1e93b9efed30738584c43fb7a5a56e9
SHA1553c7f271f7d17ff9ac8f297c78a1192b69b56ee
SHA2564fd24f699d08eb8f9322e37af49becada535e5f50ae0512b158f537a5197eb94
SHA512c23b073647f4217878aa79cb1ed9bf4f0bca8c7e79663862e6516cd51fe5a6bb144b4207fc2d03af5f172dafa85bab2e31cf0dedc107324e249cb615deaebfdc