Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 18:15
Behavioral task
behavioral1
Sample
826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe
Resource
win10v2004-20241007-en
General
-
Target
826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe
-
Size
105KB
-
MD5
531e509a09b8472abd0d4cae379b2830
-
SHA1
aa61e6b86ae7079f75e45f9c856173667c06c68c
-
SHA256
826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316
-
SHA512
5b8fb2a3bf997a3b10853437231f8f810c4e3dc9620fb6c6f367b0fa962a23b4cbeb60f5476b078f0148d7e85b464d7e0ad12a66a4b334c6baf9658f8c2c4f08
-
SSDEEP
1536:V7Zf/FAxTWoJJZENTNyoKIKMQTW7JJZENTNyoKIKMIjUv0FR:fny1tE5KIKEtE5KIK7jUv0FR
Malware Config
Signatures
-
Renames multiple (2900) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/3012-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000b0000000122ea-2.dat upx behavioral1/files/0x000200000001067f-6.dat upx behavioral1/memory/3012-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jre7\lib\management\jmxremote.access.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Mozilla Firefox\notificationserver.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\VideoLAN\VLC\AUTHORS.txt.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jre7\bin\npt.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Google\Chrome\Application\master_preferences.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jre7\bin\eula.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jre7\lib\charsets.jar.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe"C:\Users\Admin\AppData\Local\Temp\826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD56e666b8d5ded9fee072d15ce1492ac18
SHA136800e3c5ccfc7e530d0ad99eb32e979c742d2de
SHA256b805ff99090e8b0bc81284aae16a140581d2086c4b27447514c9ea50dc264d90
SHA512b576685c91fd25b0816138712eedf9b95028aeacf5be41caa80e9264381c85327f2e8070ab1688b97fb96d134f8f95cb64b9446980667eecac407484250a5044
-
Filesize
114KB
MD5b23556e935a0040ff1fada050052e6ee
SHA17f63e83a9eae15c15ad1a0e93c8611fa0f1e5710
SHA2565c88ad1b518a2893e0743c2ebd43a18da59b1ff240f8bbdea199c1a3bd0fd5f1
SHA5122c6cb51bb3f727d470eda16d998e2a488e5bfe8fee347068ff19674885bc84178247d8d3f3aa6ee7befc701a51490db717f2e4e937234ed488ad9c3d7905b759