Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 18:27
Behavioral task
behavioral1
Sample
9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe
Resource
win10v2004-20241007-en
General
-
Target
9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe
-
Size
46KB
-
MD5
37ab91bc95942249608a7fb5b9438e90
-
SHA1
10b667c5c6fd45ee63168b2204fc7651f393fe01
-
SHA256
9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53
-
SHA512
b5bf92da4a8ec87462c21fbc460caee5668f75f1b0d8fbb759020a4dedecf23106bc21bcc7953ad2d9ca147a1b5e6c690046c2aa41f097d47704c215f1cf5f6f
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiJFEFuodcOZiJSQOQiJfodcOd:CTW7JJ7TTQoQPyPhehEJyQJyv
Malware Config
Signatures
-
Renames multiple (3218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2856-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x0007000000012117-2.dat upx behavioral1/files/0x0002000000010674-6.dat upx behavioral1/memory/2856-69-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jre7\lib\javaws.jar.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jre7\bin\installer.dll.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jre7\bin\jp2launcher.exe.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\chkrzm.exe.mui.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\shvlzm.exe.mui.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe"C:\Users\Admin\AppData\Local\Temp\9cdb9ad7f9cbad8a6b427383b6dfd6eb0e88d718716315f484b326b7dfaa9c53N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD52a75dd47193f2982b29c0c89e2875a2e
SHA1121be6d8228bcccee5d1d6030c685fc8380e2342
SHA256166dde4b399ef91deb0744d7584c75ddb2b20cce4833e2497b2f8e69a76899b6
SHA51293d803624a304119a0d3045d87b31fefff9bbadb6fa2dd5c40a19aa6562b31911d98672683009bfe03050b98e697424fd8c7589222084fc7f83c0897b2baefb7
-
Filesize
55KB
MD54fa404d3c2b2fd960278dc1df127f561
SHA1a9e7c0c29d45fe3d1558c62284f3433418e493f1
SHA256a5b24a937caa1a0625961a7ea20ad2d365ce7f4aac006d31011dd6b14ee5a9a5
SHA51261af79cbc5693a19acfe2ef6a43887c4317c5857c6da33c3133d439db6ff1395e1f754a1f349a60205bb7581e2d5593307a165c64591a08f5ddd91bc04d57d64