Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 18:05
Behavioral task
behavioral1
Sample
0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe
Resource
win10v2004-20241007-en
General
-
Target
0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe
-
Size
584KB
-
MD5
e7be3031468930b44c6679487d4e97f0
-
SHA1
0098d8ea27246df367ee815407ddad7279206a6a
-
SHA256
0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9e
-
SHA512
8a3e0cba2570bb9bcffc0c5f46494d0ea7419c5a9b050d91d72bb520bf8aa0d237a9a48620506746b4abed6dba8fda525f4f0b251891278fee87047b6440fcc1
-
SSDEEP
1536:CTWciVRRNRROHrNOPLeMS+YanjU8YKLGPavsH5d6mFUejEdH1v6H1wH1I03pkTWd:hRrRgxOeORYX3FFodVv6VwVIu8X5y
Malware Config
Signatures
-
Renames multiple (1171) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2288-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000d000000012262-2.dat upx behavioral1/files/0x0002000000010674-6.dat upx behavioral1/memory/2288-69-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Taipei.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe"C:\Users\Admin\AppData\Local\Temp\0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
584KB
MD55eb1387f635d3ca8f0cf0e749cbf8e2a
SHA1627c43dd3137e3159cb4ee66f2fd0b1829913e45
SHA256024039728e0b4907efa8d08a473134e4672c7b43e144df8d396851b2a8b4173a
SHA512c65327b86c43d2b7eb9c8baf691a161251010a6167d4e36e0fa4a0141f3a36fde6f4e959db596f96c0fb623a48c6c6095b0e2148948abae645ec6b28f76bbebf
-
Filesize
593KB
MD5c819e42ef565a00304dfe12850fbf439
SHA100e1fc62c808b8700bc5ac1f5ff08808ccf7d76c
SHA25601e29ff1c6ad32114bad0b2db50cf14293cacd9c3ebb05a4e3403d4478a8cc17
SHA5123a0a45bbd2a6c6742e9c390d486e5c4439a9b4e2ccf7db00805f68e55e568f58d55ccb804d3e984d9415772d8f8fa40de88638d6e922b5bb95bcdd4f407a1cec