Analysis
- max time kernel
120s - max time network
118s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
10/10/2024, 02:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe
- Size 67KB
- Sample241010-chmaxsvbjc
- SHA256 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976
- MD5 f5797e7a2bc9412e03469c0c8f634b80
- SHA1 ab49423435cb4a393767e30240f850b23c96f7a9
- SHA512 a4e6303be046e1c17aaa881ef4e1ae4e7eb1f0706bdc340766355c4f3542389d160e033997591a4dbab6ee5af35089b086e054311fb7c90e7aa238acaf140943
- SSDEEP 1536:W7ZhA7pApw03vR03vcltdtSsU8Tu8Tmwzwh:6e7WpwYRYUtdtSsBch
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Tehran.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Manaus.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\ConvertRemove.TS.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\bin\servertool.exe.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\zi\America\La_Paz.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Internet Explorer\Timeline_is.dll.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\DVD Maker\PipeTran.dll.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe"C:\Users\Admin\AppData\Local\Temp\02896b58d34ddf8ffbc8b20e20d0dd97bc212b315901705e60066923451f5976N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp
- Size 68KB
- SHA256 07caeb916204a1882b9ade1f032193dbc031556a0bb80eba1e314c4faf39b41f
- MD5 43e239e037565844b6cc91d0436fa0b2
- SHA1 940a96aa581938e86a97cdae3feb6f56b8afc46a
- SHA512 c0c5e93d719e95e4e6e5f5cfa9c37e5ac85098dae5934fd974997db03c35077d4d30db343085a6aac7d700a5137156b405a7054eecb64663c77906b2f5c6442f
- SSDEEP 1536:W7ZhA7pApw03vR03vcltdtSsU8Tu8TmwzwG:6e7WpwYRYUtdtSsBcG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 76KB
- SHA256 9133f1ecdb6114a024162a40bd7bbc7b8fc2bb5dfb9f52e08b8408598da31a00
- MD5 e607b15dd32b315d4fbb1d321151ce7d
- SHA1 128ae39336fcd8681637815b43dbd113e7eebed8
- SHA512 99c88bd261e3232e4e4c8c1c9d557b45429f7d13446e846b633252f3e7b09b19a31096dd9dc4334f616f5cb0dfd5ff8d0028284311c7954c9be956695e2f3be8
- SSDEEP 1536:W7ZhA7pApw03vR03vcltdtSsU8Tu8Tmwzw1:6e7WpwYRYUtdtSsBc1
- MD5 SHA1 SHA512 SSDEEP