Analysis
- max time kernel
150s - max time network
121s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
10/10/2024, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe
- Size 37KB
- Sample241010-e8h3astakq
- SHA256 bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aa
- MD5 77085df35cf21d33f6b86cd14e8ee8c0
- SHA1 0509fcc6d317f8347f21cb442be83f2a253708ca
- SHA512 727a9d83fdfb07bdcf2a2e67657ba6ff5fb0565599ce179eeaa3798c00ef4be279c881fe20f8424881838b85ff97e0d4e6270c64c9bc88a8f59d8f42b545d956
- SSDEEP 384:yBs7Br5xjL8AgA71FbhvsDYcUYch4AqAJOK4AqAJOG:/7BlpQpARFbhsYcUYcdqAJPqAJX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3862) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\bin\jsound.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_disabled.png.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_sml.png.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\micaut.dll.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\library.js.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\common.js.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libfingerprinter_plugin.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\desktop.ini.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_stats_plugin.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libchain_plugin.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter.png.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jre7\lib\management\jmxremote.access.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\WISC30.DLL.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_down.png.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe"C:\Users\Admin\AppData\Local\Temp\bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp
- Size 37KB
- SHA256 6a94db09591245f562e0857c41e4e815b5b19a86434a7d30e7839783f24c063d
- MD5 1ea6a1723d586f3379832b764cef8f19
- SHA1 9428642b6d1b56c2295bb602eb9c358feab73b45
- SHA512 b7776df2ef2903498013664517d70c57664fafdf4c4fadf05c27eef5cb1569770530d802ef8f79afa487f4a9a8f836db5e9426b5aff557b8cb38d4df5e0c29d0
- SSDEEP 384:yBs7Br5xjL8AgA71FbhvsDYcUYch4AqAJOK4AqAJOf:/7BlpQpARFbhsYcUYcdqAJPqAJu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 46KB
- SHA256 35d22b1b346131050855501a15ecf5e0001a53646a37fbd28b287693add79b0c
- MD5 892bc54e374cb8ffa2c8356abaa1287a
- SHA1 478325036a2a074d3d85b3d0d4cfcfcb3f427dee
- SHA512 10176452d6aa7727345b752b70be1c0aed12d6ab629fd550a5c63a982f7dfba61f3ddd97aeb4f5b61e5b304c09762f3aa339836c50897b35698a8cc8956c7aee
- SSDEEP 768:/7BlpQpARFbhsYcUYcdqAJPqAJkN1J3DCl4N1J3DCl/:/7ZQpApsYcUYcd
- MD5 SHA1 SHA512 SSDEEP