Analysis
- max time kernel
150s - max time network
122s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
10/10/2024, 02:52
Behavioral task
behavioral1
Sample
d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe
- Size 36KB
- Sample241010-dc13ka1eln
- SHA256 d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9df
- MD5 09c3030a16e3a7d2f5494bf3fdef9300
- SHA1 4d82aef0a99e13a328d9943c6d296e3c9d23d0fd
- SHA512 bbd1040e59278c1b84b8fdb603b6f1e7773c58844d3a65ba84e710b5d412963075968a4d02e5cad1bf36604902a250583a23e1af14d8af711b8821b5dcce52c4
- SSDEEP 768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJfn6lj3Ai1xQ6lj3Ai1xr:CTW7JJ7T4MG6lbE6lbv
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4109) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/3036-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000a00000001225d-2.dat upx behavioral1/files/0x000200000001067f-6.dat upx behavioral1/memory/3036-75-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libmft_plugin.dll.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Windows Media Player\Skins\Revert.wmz.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_snow.png.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jre7\lib\logging.properties.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Half.png.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\PREVIEW.GIF.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\glow.png.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\SwitchUnblock.odt.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Windows Journal\de-DE\PDIALOG.exe.mui.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODBC.DLL.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\VideoLAN\VLC\skins\skin.dtd.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Windows Defender\MpCommu.dll.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Windows Media Player\es-ES\WMPDMCCore.dll.mui.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent.png.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll.tmp d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe"C:\Users\Admin\AppData\Local\Temp\d5a634e2af75506e967cab33e3218cc7a14802cac184728b37a9a2db4788f9dfN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp
- Size 36KB
- SHA256 85d19325f2e5818ed31540f88e60d78a20abbb450fddd61fa3c2fae50e546102
- MD5 7605831de4f3c00279a14db08006081c
- SHA1 a0f9752270b7c06b832fe051e15fb3629e24198d
- SHA512 95f4d779fc4ec2b8afd0185cbcc7f38c70bd2d494b760fb3ded4f2cc7a211b1f7ae808965f60d4248658cf629c12e938d6ec821b57a7c7b3b97f22b809b9b169
- SSDEEP 768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJfn6lj3Ai1xQ6lj3Ai1x2:CTW7JJ7T4MG6lbE6lby
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 45KB
- SHA256 a320a64d983040059dab8fd3cdfd0b7a3a46b75bbe0005d6a54e233d1b2355b7
- MD5 254ec509d891f9919552132c177523db
- SHA1 ff506556023d83e8812ef4287980c3a0340870c5
- SHA512 77bed62a27629aa6030a50cbe54d26283b8aca1f160689e2eb46018a13e8b1082c3ac7fdc6a0b2cc590ea29df19d19c3b6890b648ca5351d509ef9092c242eb6
- SSDEEP 768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJfn6lj3Ai1xQ6lj3Ai1xz:CTW7JJ7T4MG6lbE6lbX
- MD5 SHA1 SHA512 SSDEEP