Analysis
- max time kernel
149s - max time network
125s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
06/10/2024, 10:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe
- Size 56KB
- Sample241006-mxpppsvamf
- SHA256 ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1
- MD5 3a43e82e2018c006e0557f48260ee400
- SHA1 295393c408c7803106435fedef40650f144cf1bd
- SHA512 de7670b65a1f1a3b8f9d6bc9e142756682534ac5c34680696d1c08d829cee43b9ec8fd527dbf0c0034b3ec9f68400a90eedcf6052990828eb3d97a7aaa520706
- SSDEEP 768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLNdyGdyAWRGhGeGhG7Rqo:W7ZppApBULcfpHLcfpyDUdyGdymqXqn
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3755) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libty_plugin.dll.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jre7\lib\accessibility.properties.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\calendar.css.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\cpu.js.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\4.png.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\VideoLAN\VLC\skins\skin.catalog.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jre7\bin\jsound.dll.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Manaus.tmp ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe"C:\Users\Admin\AppData\Local\Temp\ba27b4a6c0bfd3d37764b05aab7abb9af68fb6d6282434abcf06bf2569d3d9c1N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp
- Size 56KB
- SHA256 daa896a1554d2a5db3bbc8c81c099092a4d43ebfea1c517a228444710d821f41
- MD5 908d936fb1210465e17684267127eabb
- SHA1 7eed02f67f8f4434c5088ba8d90c5285874910f7
- SHA512 af6288da00a10abf5645cae51305a23ccae62c3893184a62aab541af31467c962d729a031ffb35e0c1e48a200986ad85386f070533fa3d8f9fa6393b1b828ef0
- SSDEEP 768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLNdyGdyAWRGhGeGhG7Rqc:W7ZppApBULcfpHLcfpyDUdyGdymqXqP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 65KB
- SHA256 6597654c6c1af18970edb6e38238f53bdd872f5b6ccd49199f237f7c2446b722
- MD5 b5e2a56c7c8104e4371eb94257f44530
- SHA1 77af95f236331af976644fb94a4b5d58a7f30138
- SHA512 b341d664499f50fb9f358f4c8e9f3728fa1d1ce8494811ddb727c301d14ff1b9e60c3608e39178c1b88ff9d651034a8407aa9abe0bfc69fbef2ba6c60b0a159f
- SSDEEP 768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLNdyGdyAWRGhGeGhG7RqT:W7ZppApBULcfpHLcfpyDUdyGdymqXqE
- MD5 SHA1 SHA512 SSDEEP