Analysis
- max time kernel
150s - max time network
124s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
10/10/2024, 08:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe
- Size 45KB
- Sample241010-ktlsjasdpc
- SHA256 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426a
- MD5 e483e796920156462e2b2094a31691b0
- SHA1 cbb0da27efa1c25762ff2fd5845857e9f397b545
- SHA512 bb4da4fb453719cc7e55e3eb31df85b69cf8c5ec9bf0b6697c28f97db4702b3621a0ba70bac7b716eac776dddfbb125c910be95abe586238b1543c78b6563c60
- SSDEEP 768:W7BlpppARFbhjbhQYjY+WyKoIWbsHfySkT5GeQbyi348oWc1RPOzkjId6q8UdrS6:W7ZppApBMyKoIWbsHfySkT5GeCyi348F
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (1257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\EnterConnect.avi.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\7-Zip\readme.txt.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Internet Explorer\msdbg2.dll.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe"C:\Users\Admin\AppData\Local\Temp\09868f1b27ed261a2c0cf0299a992d27a4ce600a81ce4331ccfad49ce1f1426aN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp
- Size 46KB
- SHA256 a42c990a6b2d950e9029d98190582b02a61e965f373807ff2fde53d531f05c75
- MD5 90ceb2b21659946a93295f3286b9237d
- SHA1 c7d8480c67058227d65e732716eba558d928e84b
- SHA512 51154619382f78ea2f5673c264b56dc94161f91c3576150311d13d606d4b271c5909fa462f2be7cea7c564bb47efc41a7d7abf8828449a5d123e8c84fe1391b4
- SSDEEP 768:W7BlpppARFbhjbhQYjY+WyKoIWbsHfySkT5GeQbyi348oWc1RPOzkjId6q8UdrSk:W7ZppApBMyKoIWbsHfySkT5GeCyi348T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 55KB
- SHA256 4b0437ca1eb29b4199ad59ab1f06bb00ca093512592135a8444ce1045ecf6814
- MD5 658cfe5e04e23956b5025de0c21d43a5
- SHA1 188463726d1c03f0597b4bae88d70d304ca46b67
- SHA512 108a5b01c06d4a3a38369ccca6c4a180efb7ae8676f3df27a8f776c730505d3af1f21dd71710f4e8c9ed9e1cac96617a8b632875e928c02d063b96708933ea51
- SSDEEP 1536:W7ZppApBMyKoIWbsHfySkT5GeCyi348oWGRPOzkjId6q8UdrSD+kCoIfL2YwqAFA:6pWpBMyKoIWbsHfySkT5GeCyi348oWGe
- MD5 SHA1 SHA512 SSDEEP