Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 18:33
Behavioral task
behavioral1
Sample
fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe
Resource
win10v2004-20241007-en
General
-
Target
fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe
-
Size
91KB
-
MD5
e0718f52ea032fcf4f13d89fb1349c30
-
SHA1
a5213072ee2681173dac5ed1678df7c804813c2b
-
SHA256
fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216
-
SHA512
c24d0ea24e8d4dd664f3f7eb68b864fa5cc15965f8cb102468a9fde955c1bfaf84cb9c71dac58b93c0a940391da527ba766390b94061d662f351ddaeca6f0049
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5v:fnyiQSox5v
Malware Config
Signatures
-
Renames multiple (2843) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2344-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000d0000000122e4-2.dat upx behavioral1/files/0x000200000001067f-6.dat upx behavioral1/memory/2344-68-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-print.xml_hidden.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Mozilla Firefox\vcruntime140.dll.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe"C:\Users\Admin\AppData\Local\Temp\fef2d1c8ccb75f3324f7eaabaf07d3f683664b40f3f0cf0ceffbb3834733b216N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD575eb3b1d32baf0c5a5fb4677cedceaf8
SHA140f18a099137c3af7e40d7ee405f83baea4c2cfc
SHA2563d74f1a7a4b60b9891e130e8425ec0d0d30a65cdaca74f60f04a610ee646e866
SHA512ce485b1f01f24169d000ed844905913857d91ccf4aa0d90a0ad3552cb06dfd1c67459bf88329d1e6a22435bb973ae5fc8dd33076d81ad6e6259cc87bb3c803f8
-
Filesize
100KB
MD54777b5a587a095b8631c0b0c85aa20ba
SHA1a35db64adc18730ce008d6444d766918f9f6e0da
SHA25621acd50d131e1fa5101b58f6a4e2251839d38fd4acf34aa585947934dc03ac39
SHA512f52810b4662025bdcbc656472a429a04d1eb11a1020b1110a3eda446771107b2ce29805d211bbbf4e0a6057d884fd1756d1c315bfc65fdaafcad308ad6673102