Analysis
-
max time kernel
120s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 17:39
Static task
static1
Behavioral task
behavioral1
Sample
22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe
Resource
win10v2004-20241007-en
General
-
Target
22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe
-
Size
59KB
-
MD5
d3bcb5cf6d217b72d3c849354e69c810
-
SHA1
7b57c43fdc03c155b1f156f8b73f64762b45b713
-
SHA256
22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6
-
SHA512
cabaac3f75ae11c4da9308e5fc10e5b5bfd6b78fbddc1280bf6984555bd4b5b492eeb1df097bbce5b89f4ca801cca788a771f662859fa32cfb607874f13d9b81
-
SSDEEP
768:W7BlpppARFbhHFoqAJwBqAJw1VyjVy/3sY1YxwDwk595E:W7ZppApyVyjVy7Uk595E
Malware Config
Signatures
-
Renames multiple (3191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\zi\America\Havana.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Colombo.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Maldives.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\ConfirmGroup.odp.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jre7\bin\jp2ssv.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe"C:\Users\Admin\AppData\Local\Temp\22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:276
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD57a4c121d0b3866bfdc55411d4641537c
SHA12f7281f3e8130b41f89229f3ab964051d165ad88
SHA2567a84ae96ee7a7bddb101e5dcb02af8491302d39bcddfb106f5a7bfe3084b73de
SHA512080dceedc47c6c5e830f888d89935d86d58ba7f3a742990f771f34515bf0b008497edc148fd3ba91574f054a1d7d34566f09631aeff4ff9575159cd09defd53a
-
Filesize
68KB
MD56819274521f240d15ac2fd475f94fd4f
SHA1cab10e46e876a98123770cf750619e0b1a9bae88
SHA25662f5348970b34997c0c9044226f83d510d0bbc00ea3c2519b0821da437434965
SHA512ff42b347aeb3bc0f4aa2cc3a04734969f96e1d01e9f6eefaf4b91d0009cfdde9a71dfca1346fa6858a612b038ffffe4a1fc193a7f6e5170488fbccda237d92dd