Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 17:09
Behavioral task
behavioral1
Sample
db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe
Resource
win10v2004-20241007-en
General
-
Target
db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe
-
Size
53KB
-
MD5
190e084a8a0725a34603fd2bb32fcf90
-
SHA1
44b2a02367142703fd64f65c2adac46904d11667
-
SHA256
db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0a
-
SHA512
abb99d507b62365ddb64122b01989895a0975511ac7b5210649a90d959fc1e448d9a70703bc01e0d585fb5e6092d36b5e98bd212bbcb6a9313505011e114dda7
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9V:V7Zf/FAxTWoJJ7Tj
Malware Config
Signatures
-
Renames multiple (3733) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/3064-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0063000000011c27-2.dat upx behavioral1/files/0x0002000000010621-6.dat upx behavioral1/memory/3064-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\mip.exe.mui.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jre7\bin\pack200.exe.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\picturePuzzle.js.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Brunei.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\settings.js.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\settings.js.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Windows Sidebar\fr-FR\sbdrop.dll.mui.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2ssv.dll.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe"C:\Users\Admin\AppData\Local\Temp\db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5c88dd2e72d67d9a156dc26050842e580
SHA128a0c56ff52b187977a6932c7a34ae9ff33b0842
SHA256f7d483f5b59c6de3905d2f4e4b14af2fb5665351b3078314399042ca91be51b7
SHA512d5d9f41025b4cee1db758d028eed85c10ebc2fffcb460788a2025f9def4259c0d0d3edd526fc8193de621fb6c53a8dba10976577da590b7e19d93a08617f063f
-
Filesize
62KB
MD50a3c3a5cdd23ef962b35c14b94587c90
SHA17581c2b65ad2592e33ba6c3aa648adadac65e7f5
SHA2563fecdd7b77cd273fafa8f2def28e4f5e9f542262af3415fb228c4759ae4eb429
SHA5126df3d1767c2ff825498de427f40e35b5b6224a1f58678a6c1bf687867e2c0d6c775b48a63773cc0c39ccdee7f57f5239e1cfe6cbd7d4ab996544820aee2c30f6