Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 17:50
Behavioral task
behavioral1
Sample
e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe
Resource
win10v2004-20241007-en
General
-
Target
e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe
-
Size
83KB
-
MD5
12246670c4180d7e8b8dacb36ee0b5b0
-
SHA1
bbd878e89bf73e1cb3ad38b26c6e2de2ef3d409f
-
SHA256
e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0
-
SHA512
3d7aef7c9a65f91a02de2047c378ad23362b1fefdd7b8417ba6f97a57702b9fd87e30a19aeb2cc785992f177ac839abc5c68169f3f02c2c5af55127c65f88acf
-
SSDEEP
1536:V7Zf/FAxTWoJJZENTBHfiPtEOeu0STqbf/xv3KB:fny1tEs0Sm3KB
Malware Config
Signatures
-
Renames multiple (3140) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1564-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0005000000010300-2.dat upx behavioral1/files/0x000200000001067f-6.dat upx behavioral1/memory/1564-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jre7\bin\jfr.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\UnregisterBlock.3gpp.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jre7\bin\t2k.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Santarem.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jre7\README.txt.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\DVD Maker\Pipeline.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\SyncRemove.wmf.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jre7\bin\fontmanager.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jre7\bin\javafx-font.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe"C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD561a1898199f39cd90ea4297833897876
SHA13d95df1da6935cc199921f414d5a3f1786df522b
SHA256d7d2e3197020371d658e9f919c62226da1f1f40f1e3530be1368b16db69fd9c2
SHA5122b5f92dba1cf87444849b7b379335185811827151d93d060656370e81a106424c6594177a3924ea70979c6453117b7ef0caeec2fc5cfff08caee92c7058b6359
-
Filesize
92KB
MD58fdf25c9c8b488d17eca607d520a2abb
SHA183d4b6a03ce3f24300b064235ee4282b642a8644
SHA25601da03a45be305f8f3451c77c596ab12e0b11b9df783c752295c942003af17ed
SHA512a900d470cf6ae1a0141073be0ccf6e6d7dd6640283bf47525132b835e9b2fb6bfdcd1fe87fbd4f273802c2bf31e1eb18de6870a4871c26c2c3ca61d349957ca5